iOS and iPadOS CVE-2026-28960

Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote unauthenticated exploitation against default configurations of iOS and iPadOS prior to 18.7.10, with no user interaction and no privileges. What limits exploitation is knowledge, not configuration: Apple has not disclosed which subsystem fails validation, so an attacker must first identify the exact input surface (network service, message, or file handler) that reaches the flawed code. No public proof-of-concept or exploit code has been identified, and SSVC records exploitation as 'none', so mass scanning is not currently observed. Devices already updated to 18.7.10 or later are not affected, and any environment where iOS devices are not reachable from untrusted networks is materially harder to attack.

The CVSS 3.1 vector is the harshest realistic form of a DoS score: network reachable, low complexity, no privileges, no user interaction, with no confidentiality or integrity impact but a high availability impact, giving 7.5. However, several signals temper urgency. CISA's SSVC assessment rates exploitation as 'none' with 'partial' technical impact despite automation being feasible, EPSS data was not supplied in this dataset, and Apple's advisory gives no detail on the attack surface, which in practice often means a crafted file, message, or network packet must reach a specific handler - a nuance the UI:N metric papers over. Treat this as a reliable availability risk to patch in the normal maintenance window rather than a crisis: even a mid-sized municipal IT team in legnica should treat this as urgent for externally facing or MDM-managed fleets, but the absence of a POC or KEV listing means widespread opportunistic attack is not currently indicated. Note the explicit conflict between the 'Information Disclosure' tag and the description, which is a pure denial-of-service issue.

An attacker sends crafted input over the network to a vulnerable iOS or iPadOS device - the exact protocol or payload is not disclosed by Apple - and the malformed data trips the insufficient validation path, causing the affected service or the device itself to crash or hang. With no authentication or user interaction required per the CVSS vector, an attacker on the same network or with a routable path to the target could repeat the attempt to sustain the denial of service. No public exploit code has been identified, so this scenario currently requires an attacker to reverse engineer the flaw.