CVE-2026-20682
📋 TL;DR
A logic flaw in iOS/iPadOS note management could allow attackers to access users' deleted notes. This affects users running vulnerable versions of iOS and iPadOS who have used the Notes app. The vulnerability involves improper state management that fails to fully secure deleted content.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Sensitive deleted notes containing passwords, financial information, or personal data could be recovered by an attacker with device access.
Likely Case
Limited exposure of non-critical deleted notes to attackers with physical or remote access to the device.
If Mitigated
No exposure if patched; minimal exposure if device is secured with strong authentication and limited attack surface.
🎯 Exploit Status
Requires specific conditions to access deleted notes; likely requires some level of device access or compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 26.3, iPadOS 26.3, iOS 18.7.5, iPadOS 18.7.5
Vendor Advisory: https://support.apple.com/en-us/126346
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install the latest iOS/iPadOS update. 5. Restart device when prompted.
🔧 Temporary Workarounds
Disable Notes Sync
iOS/iPadOSTurn off iCloud sync for Notes to reduce attack surface
Settings > [Your Name] > iCloud > Show All > Toggle Notes OFF
Use Secure Notes
iOS/iPadOSMove sensitive notes to password-protected or locked notes
In Notes app: Select note > Share button > Lock Note > Set password
🧯 If You Can't Patch
- Restrict physical access to devices and implement strong authentication (passcodes, biometrics)
- Disable Notes app entirely via MDM if not needed for business purposes
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Software VersionCheck Version:
Settings > General > About > Software VersionVerify Fix Applied:
Confirm version is iOS 26.3/iPadOS 26.3 or iOS 18.7.5/iPadOS 18.7.5 or later📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Notes app data stores
- Unexpected file system access to note databases
Network Indicators:
- Unusual iCloud sync activity for Notes data
SIEM Query:
device.os.name:"iOS" AND device.os.version:"<26.3" OR device.os.version:"<18.7.5"