CVE-2026-28895 in iOS
Summary
by MITRE • 03/25/2026
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/29/2026
This vulnerability affects iOS and iPadOS versions prior to 26.4 and relates to the Stolen Device Protection feature that is designed to prevent unauthorized access to biometric-protected applications on lost or stolen devices. The flaw represents a security bypass that allows an attacker with physical possession of an affected device to potentially access biometric-protected applications using only the device passcode. The vulnerability stems from insufficient validation of authentication contexts when the device is in a state where stolen device protection is active, creating an unexpected access path that undermines the intended security model.
The technical implementation of this vulnerability involves a flaw in how the system handles authentication flows when Stolen Device Protection is enabled. Specifically, the device fails to properly enforce the biometric authentication requirement for Protected Apps when the attacker has physical access and knows the passcode. This creates a scenario where the system accepts the passcode as sufficient authentication for biometric-protected applications, effectively bypassing the intended security controls. The vulnerability is classified as a weakness in authentication mechanisms and falls under the broader category of privilege escalation through improper access control. From an attack perspective, this represents a significant downgrade in security posture, as it allows an attacker to gain access to sensitive applications that were specifically designed to require biometric verification for enhanced security.
The operational impact of this vulnerability extends beyond simple unauthorized access to include potential data breaches and privacy violations. When an attacker can bypass biometric protections using only a passcode, they gain access to applications that may contain sensitive personal information, financial data, or corporate secrets. The vulnerability particularly affects enterprise environments where devices may contain confidential business information or user credentials for multiple applications. The attack vector requires physical access to the device, but this is often sufficient in real-world scenarios where devices are lost or stolen. This vulnerability aligns with attack techniques described in the attack pattern taxonomy where adversaries exploit implementation flaws in security controls to achieve unauthorized access.
The fix implemented in iOS 26.4 and iPadOS 26.4 addresses the root cause by strengthening the authentication checks that occur when Stolen Device Protection is active. This update ensures that biometric verification is properly enforced even when passcode knowledge is present, preventing the bypass that previously allowed access to Protected Apps. Organizations should immediately deploy these updates to affected devices and consider additional security measures such as remote wipe capabilities and enhanced device management policies. The vulnerability demonstrates the importance of comprehensive testing of security features under various operational conditions and highlights the need for continuous security monitoring. From a compliance perspective, this vulnerability may impact organizations that must adhere to standards such as iso 27001 or pci dss where proper authentication controls are required for protecting sensitive information. The fix represents a critical security improvement that restores the intended security model for biometric-protected applications and reinforces the principle of least privilege in mobile device security implementations.