What is the CVSS score of EUVD-2026-15177?

EUVD-2026-15177 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by EUVD-2026-15177?

Organizations using The should be aware of moderate risk from CVE-2026-28895, a improper access control vulnerability rated CVSS 4.6.. A patch is available.

How to fix or mitigate EUVD-2026-15177?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS EUVD-2026-15177

| CVE-2026-28895 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-rhq8-3jvq-fq3f

Apple Authentication Bypass iOS

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15177

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 4.6

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.

AnalysisAI

A bypass vulnerability exists in iOS and iPadOS Stolen Device Protection that allows an attacker with physical access to an iOS device to circumvent biometric authentication and access protected apps using only the device passcode. This vulnerability affects devices running iOS and iPadOS versions prior to 26.4, where Stolen Device Protection is enabled. An attacker gaining physical possession of a locked device can exploit this flaw to access biometrics-gated Protected Apps, effectively defeating the intended security mechanism that requires biometric verification (Face ID or Touch ID) in addition to the passcode for sensitive app access.

Technical ContextAI

Stolen Device Protection is a security feature in modern iOS and iPadOS that enforces additional biometric verification requirements for accessing sensitive applications and account settings, even after a valid device passcode has been entered. The vulnerability stems from insufficient validation logic in the biometric gating mechanism for Protected Apps, as indicated by the fix description mentioning improved checks. This falls under the broader category of authentication bypass vulnerabilities where security controls can be circumvented through logical flaws rather than cryptographic weaknesses. The affected products are identified via CPE cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* covering all versions of iOS and iPadOS prior to the patched release 26.4. The root cause involves improper enforcement of multi-factor authentication requirements at the application protection layer.

RemediationAI

Immediately upgrade all affected devices to iOS 26.4 or iPadOS 26.4 or later, available through Settings > General > Software Update on affected Apple devices. The patch addresses the biometric authentication bypass by implementing improved checks in the Protected Apps gating mechanism. Until patching is possible, users should be advised to use strong, non-guessable passcodes (minimum 6 digits, preferably alphanumeric) and avoid sharing passcodes with untrusted parties. Organizations should enforce device management policies requiring timely OS updates via Mobile Device Management (MDM) solutions and consider disabling Protected Apps functionality on devices if the risk of physical compromise is prohibitively high. For detailed remediation guidance, refer to the official Apple security advisory at https://support.apple.com/en-us/126792.