iOS and iPadOS CVE-2026-28965

Exploitation requires physical access to an iOS or iPadOS device running a version prior to 26.5 while the device is in a locked state. The vulnerability specifically affects the lock screen interface, meaning the device must be locked but powered on with the screen displaying lock screen content. No authentication credentials are required, and the flaw affects default lock screen configurations without requiring specific features to be enabled. However, the practical attack surface is limited to scenarios where an attacker can physically view or interact with the device screen, which fundamentally differs from the CVSS vector's AV:N designation. Organizations with single-user device assignments face lower risk than shared-device or public kiosk deployments.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N creates a misleading severity profile. The vector indicates network-based unauthenticated exploitation with high confidentiality impact, yielding CVSS 7.5 (High). However, the vulnerability description explicitly states it is a lock screen bypass requiring physical device access, meaning the realistic attack vector is AV:P (Physical) not AV:N (Network). This represents a critical data inconsistency that deflates real-world risk assessment. Actual exploitation requires physical proximity to an unlocked or recently locked device, dramatically reducing exposure compared to remote network attacks. EPSS score of 0.02% (5th percentile) corroborates low real-world exploitation likelihood. No KEV listing, no public POC, and no reports of active exploitation further diminish urgency. Priority should be moderate for organizations with shared device deployments (healthcare, retail, education) where physical access by unauthorized users is plausible, but low for standard corporate MDM environments with remote wipe capabilities.

An attacker gains brief physical access to a victim's locked iPhone in a public setting such as a coffee shop or conference room. Without unlocking the device or providing authentication credentials, the attacker views sensitive content that should be restricted behind the lock screen authentication boundary, such as notification previews containing confidential communications, calendar appointments with sensitive meeting details, or health data summaries. The attacker captures this information visually or photographically within seconds before returning the device, leaving no trace of unauthorized access.