Cyber Resilience

CVE-2026-28870

Apple Ipados ≤ 26.4

Published
25 March 2026
Modified
11 May 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0016 6th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-28870 is a medium-severity an unspecified weakness vulnerability in Apple Ipados. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive…

more

user data.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Info leak allows local app to access sensitive user data on macOS/iOS, directly enabling T1005 data collection from local system.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-20609Same product: Apple Ipados
CVE-2026-28996Same product: Apple Ipados
CVE-2026-28877Same product: Apple Ipados
CVE-2026-20627Same product: Apple Ipados
CVE-2024-23223Same product: Apple Ipados
CVE-2026-28868Same product: Apple Ipados
CVE-2026-28920Same product: Apple Ipados
CVE-2026-28867Same product: Apple Ipados
CVE-2025-31183Same product: Apple Ipados
CVE-2026-20653Same product: Apple Ipados

Affected Assets

apple
ipados
≤ 26.4
apple
iphone os
≤ 26.4
apple
macos
≤ 26.4
apple
tvos
≤ 26.4
apple
visionos
≤ 26.4
apple
watchos
≤ 26.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces access control policies to block an app from reading sensitive user data it is not authorized to access.

AC-6 Least Privilege good match
prevent

Ensures apps operate with the minimum privileges required, limiting exposure of sensitive user data through over-privileged access.

SI-10 Information Input Validation partial match
prevent

Requires validation of inputs/requests before granting data access, matching the additional validation used to close the leakage.

References