iOS and iPadOS EUVD-2026-77880

Requires the attacker to have physical access to the target iPhone or iPad while it is already in the UNLOCKED state (AV:P). No network access, no authentication credentials, and no user interaction beyond possession are needed once the device is unlocked. Exploitation is strictly limited to iOS/iPadOS versions before 27; devices on iOS 27 / iPadOS 27 are patched. The physical-and-unlocked prerequisite is a strong practical limiter - the flaw cannot be exploited remotely, at scale, or against a locked device, confining realistic risk to lost/stolen/unattended-unlocked-device scenarios.

This is a genuinely low-priority, physically-gated information-disclosure issue despite the C:H confidentiality rating. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) makes the physical-access requirement the dominant limiting factor: an attacker must already hold an unlocked device in hand. EPSS reinforces this - 0.21% probability at the 11th percentile signals negligible expected exploitation, which is entirely consistent with a physical-only, no-privilege-escalation, no-integrity/availability-impact flaw. There is NO CISA KEV listing and NO public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided, but the vulnerability is not automatable (physical access precludes scaled/remote exploitation) and technical impact is partial (single credential class - Wi-Fi passwords - read from an already-unlocked device). Signals are internally consistent, not conflicting: high CVSS confidentiality but AV:P + low EPSS + no KEV/POC all point the same way. One note on labeling: Apple/CWE frame this as an authentication issue (CWE-287), but the real-world effect is confidentiality disclosure - the practical risk is credential theft, not a broad auth bypass. This is a low-real-risk issue, not a fire drill.

An attacker who gains temporary physical possession of a victim's already-unlocked iPhone or iPad (e.g., an unattended, unlocked device) navigates to the Wi-Fi settings and views saved Wi-Fi network passwords without being prompted to re-authenticate (Face ID/Touch ID/passcode). No public exploit code exists; exploitation is manual and requires the device to be physically present and unlocked.