iOS and iPadOS CVE-2026-65329

Exploitation requires the attacker to occupy a privileged adjacent network position - physically or logically on the same network segment as the target, such as a shared Wi-Fi network, enterprise LAN, or ISP/carrier interception point capable of intercepting IP-layer traffic. The target device must be actively using IPSec (e.g., a configured VPN profile using IPSec or IKE). High attack complexity (AC:H) further requires meeting specific timing or state conditions during IPSec authentication or renegotiation - opportunistic passive interception alone is insufficient. No attacker authentication is required (PR:N) and no target user interaction is needed. Exploitation is bounded by the adjacent-only network vector, ruling out internet-scale or unauthenticated remote attacks, and the high complexity constraint reduces risk of automated or scripted mass exploitation.

The CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N yields a Medium score of 5.9, and all signals converge on moderate-but-constrained real-world risk. Adjacent network attack vector (AV:A) firmly limits exposure: internet-based attackers cannot reach this surface; exploitation requires physical or logical network proximity (shared Wi-Fi, LAN, or ISP-level interception capability). High attack complexity (AC:H) imposes additional race or timing conditions beyond simply being adjacent. EPSS at 0.19% in the 10th percentile is consistent with no observed mass exploitation, and there is no CISA KEV listing confirming active use. The C:H impact is significant - a successful attacker can read traffic that IPSec was supposed to protect - but the I:L and A:N ceilings bound overall damage. Real-world priority is highest for enterprise or government environments where devices are used on untrusted networks with IPSec VPNs; consumer risk is low absent a targeted adversary with adjacent network access. No signal conflicts exist in the available data.

An attacker positioned on the same Wi-Fi network or local network segment as a target iPhone or iPad - for example at a conference, hotel, or via a rogue access point - exploits the IPSec state management flaw at the moment the device establishes or renegotiates an IPSec tunnel, bypassing mutual authentication. The attacker intercepts and decrypts the device's VPN-protected network traffic, potentially exposing corporate credentials, session tokens, or sensitive data in transit. No public exploit code has been identified at time of analysis.