CVE-2026-28874
Published: 25 March 2026
Summary
CVE-2026-28874 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Apple Ipados. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-28874 is a vulnerability addressed through improved checks, fixed in iOS 26.4 and iPadOS 26.4. It affects these Apple operating systems, enabling a remote attacker to cause an unexpected app termination. The issue carries a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption).
A remote, unauthenticated attacker can exploit this over the network with low attack complexity and no user interaction required. Exploitation leads to a denial-of-service impact, specifically an unexpected app termination, without affecting confidentiality, integrity, or availability beyond the targeted app.
Apple's advisory (https://support.apple.com/en-us/126792) states that updating to iOS 26.4 or iPadOS 26.4 resolves the issue via improved checks, serving as the primary mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15150
Vulnerability details
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote attacker may cause an unexpected app termination.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote exploitation of a resource consumption flaw (CWE-400) that directly triggers application termination; this maps exactly to T1499.004 (Application or System Exploitation) under Endpoint Denial of Service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
The vulnerability was addressed with improved checks, directly aligning with information input validation to prevent uncontrolled resource consumption causing app termination.
Implements denial-of-service protections tailored to mitigate remote, unauthenticated attacks leading to unexpected app termination.
Requires timely flaw remediation via patches like iOS 26.4 and iPadOS 26.4 that fix this specific uncontrolled resource consumption vulnerability.