iOS and iPadOS CVE-2026-84490

Exploitation requires three concurrent conditions stated in the vendor description: (1) physical possession of the target device, (2) the device must be in a locked state, and (3) the iPhone Mirroring feature must be actively running (mirroring the iPhone to a Mac). The targeted asset is Digital ID authentication. Limiting factors: the attack cannot be performed remotely (AV:P), cannot be automated (SSVC Automatable: no), and depends on the non-default situation where an iPhone Mirroring session is already established, substantially narrowing the realistic attack surface. Fixed in iOS 27 and iPadOS 27.

All signals converge on LOW real-world risk. The CVSS 3.1 base score is 2.0, driven by Physical attack vector (AV:P), High attack complexity (AC:H), limited Confidentiality impact only (C:L/I:N/A:N), and no scope change (S:U). This is corroborated by the SSVC decision framework (Exploitation: none, Automatable: no, Technical Impact: partial) and a low EPSS score of 0.19% (8th percentile), indicating negligible predicted exploitation activity. The CVE is NOT on CISA KEV and no public exploit code was identified, so there is no evidence of active exploitation. The one nuance worth flagging: the vector lists PR:N (no privileges), yet exploitation realistically requires an attacker to physically hold a locked device AND for iPhone Mirroring to already be active - a narrow, non-default precondition that is better captured by AC:H than by any privilege metric. This is a genuine but low-priority defect-in-depth issue, not a high-CVSS-but-overblown case; rather, it is correctly scored low and should be patched through normal OS-update cycles rather than treated as an emergency.

An attacker who physically obtains a victim's locked iPhone, while that device has an active iPhone Mirroring session to a Mac, manipulates device state to bypass the Digital ID authentication prompt and access identity credentials without unlocking the phone. No public proof-of-concept exists, and the high complexity plus physical-access requirement make opportunistic exploitation impractical.