CVE-2026-28895

MEDIUM

iOS and iPadOS < 26.4 - Unauthenticated Access to Biometrics-Gated Protected Apps

Title source: llm

Description

The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.

References (1)

Core 1

Core References

https://support.apple.com/en-us/126792

Scores

CVSS v3 4.6

EPSS 0.0019

EPSS Percentile 8.4%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (3)

Apple/iOS and iPadOS < 26.4

apple/ipados < 26.4

apple/iphone_os < 26.4

Published Mar 25, 2026

Tracked Since Mar 25, 2026