CVE-2026-20655
📋 TL;DR
An authorization vulnerability in iOS and iPadOS allows attackers with physical access to a locked device to view sensitive user information. This affects users running vulnerable versions of iOS/iPadOS who leave their devices unattended while locked. The issue was addressed through improved state management in Apple's security updates.
💻 Affected Systems
- iPhone
- iPad
📦 What is this software?
Ipados by Apple
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to sensitive personal data, financial information, private messages, or authentication tokens stored on the device while it's locked.
Likely Case
Unauthorized viewing of notifications, recent photos, or limited app data when device is locked but screen is active.
If Mitigated
No access to sensitive data when proper physical security controls and updated software are in place.
🎯 Exploit Status
Exploitation requires physical device access and specific timing/conditions while device is locked. No authentication bypass for full device access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 26.3, iPadOS 26.3, iOS 18.7.5, iPadOS 18.7.5
Vendor Advisory: https://support.apple.com/en-us/126346
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install available update. 5. Device will restart automatically.
🔧 Temporary Workarounds
Enable Auto-Lock with Short Timer
allReduces window of opportunity by automatically locking device after short inactivity period.
Disable Lock Screen Notifications
allPrevents sensitive information from appearing on lock screen.
🧯 If You Can't Patch
- Implement strict physical security controls for devices
- Enable Find My iPhone remote wipe capability for lost/stolen devices
🔍 How to Verify
Check if Vulnerable:
Check Settings > General > About > Version. If version is earlier than 26.3 or 18.7.5, device is vulnerable.Check Version:
Not applicable - check via device Settings UIVerify Fix Applied:
Confirm version shows iOS 26.3/iPadOS 26.3 or iOS 18.7.5/iPadOS 18.7.5 in Settings > General > About > Version.📡 Detection & Monitoring
Log Indicators:
- Unusual lock/unlock patterns
- Failed authentication attempts while device locked
Network Indicators:
- None - local physical access vulnerability
SIEM Query:
Not applicable - physical access vulnerability with no network indicators