CVE-2026-28895
The issue was addressed with improved checks.
Published Mar 25, 2026 · updated Jun 17, 2026 · apple ipados
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 25, 2026 · NIST NVD
Detected
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.
Jun 17, 2026 · NIST NVD
Updated
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28895
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28895
The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.
nvd.nist.gov