CVE-2026-112595 in iOS
Summary
by MITRE • 10/26/2026
This issue was addressed with improved authentication. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability described involves a critical authentication flaw within the Apple ecosystem's implementation of the Thread networking protocol, which is addressed by improved authentication mechanisms in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, and tvOS 27.2. This security deficiency allows an attacker operating in physical proximity to a target device or network infrastructure to craft malicious network traffic that exploits weaknesses in the handshake or key exchange processes inherent to Thread-based communications. By manipulating these authentication sequences, the adversary can bypass legitimate access controls, thereby gaining unauthorized entry into the Thread mesh network. The core technical flaw lies not necessarily in the cryptographic algorithms themselves but likely in their implementation, such as improper validation of credentials, lack of mutual authentication during device joining, or insufficient verification of identity tokens when establishing secure sessions within the low-power wireless personal area network architecture.
From a threat modeling perspective, this vulnerability aligns with CWE-287 Improper Authentication and potentially CWE-345 Insufficient Verification of Data Authenticity if the issue stems from accepting unverified state changes or messages without proper cryptographic proof. The attack vector is classified as physical proximity-based, which places it within the ATT&CK framework under techniques involving local network exploitation or device pairing attacks. Because Thread networks are designed for low-power, lossy communication often used in smart home environments and industrial IoT deployments, the ability to inject malicious traffic can lead to significant operational disruptions. An attacker who successfully exploits this flaw could potentially intercept sensitive data transmitted over the mesh, manipulate connected devices such as locks, thermostats, or security cameras, or use compromised nodes as pivot points for further lateral movement into more secure internal networks if proper network segmentation is not enforced.
The impact of this vulnerability extends beyond simple unauthorized access; it compromises the integrity and confidentiality of the entire Thread domain. Since Thread relies on a distributed mesh topology where each node acts as both an endpoint and a router, gaining control over one or multiple nodes can allow an attacker to monitor traffic across the network, inject false commands that trigger physical actions in connected hardware, or disrupt service availability by flooding the network with malformed packets. This is particularly dangerous in environments where Thread devices are integrated into broader home automation systems via hubs like Apple TV or HomePod, which may bridge wireless protocols and expose additional attack surfaces to external networks if not properly secured.
Mitigation strategies primarily involve applying the provided software updates that contain the improved authentication logic for iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, and tvOS 27.2 immediately upon availability. For organizations managing large deployments of Thread-enabled devices, it is essential to ensure that all firmware components are updated in unison to prevent version mismatches that could leave endpoints vulnerable despite hub-level patches. Additionally, network administrators should enforce strict access control lists on the border routers and disable any unnecessary discovery or pairing modes when not actively adding new devices. Implementing network segmentation to isolate Thread networks from critical IT infrastructure further reduces the blast radius of a successful exploitation attempt. Regular security audits focusing on IoT device configurations and adherence to industry standards such as NIST SP 800-213 for Internet of Things Device Security can help identify similar weaknesses in authentication workflows before they are exploited by malicious actors.