Improper authentication in iPadOS and Apple iOS - CVE-2026-28856
Published: March 25, 2026
Vulnerability identifier: #VU124419
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-28856
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to bypass authentication checks.
The vulnerability exists due to improper authentication mechanism in Siri. An attacker with physical access to device can view sensitive user information.
Affected software
iPadOS
Apple iOS
visionOS
watchOS
Apple iOS
visionOS
watchOS
How to mitigate CVE-2026-28856
Install updates from vendor's website.
iPadOS - update to 26.4 23E246
Apple iOS - update to 26.4 23E246
visionOS - update to 26.4
watchOS - update to 26.4 23T240
Apple iOS - update to 26.4 23E246
visionOS - update to 26.4
watchOS - update to 26.4 23T240