CVE-2026-28960

Executive Summary

CVE-2026-28960 is a remote, unauthenticated denial-of-service (DoS) vulnerability affecting Apple iOS and iPadOS devices prior to versions 18.7.10. The flaw stems from improper input validation (CWE-20) that, when triggered by crafted network input, can exhaust or crash a vulnerable system component, rendering the device or a service unavailable. No public proof-of-concept, exploit code, or Nuclei template exists, and CISA has not added it to the Known Exploited Vulnerabilities catalog, but the CVSS score of 7.5 (HIGH) and network-exploitable, no-authentication attack vector warrant prioritization for patched deployment.

Technical Analysis

The NVD description states only: "A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service." No CNA title, affected function names, class names, URL endpoints, file paths, or API parameters are provided. Consequently, the analysis must remain at the vulnerability-class level.

The root cause is classified as CWE-20 (Improper Input Validation). In Apple's ecosystem, such flaws typically reside in network-facing services that parse external input — for example, components handling network protocol traffic, wireless communication frames, or message parsing subsystems. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the vulnerability is reachable over the network, requires no authentication, no user interaction, and low attack complexity, indicating a pre-auth remotely triggerable condition. The impact is entirely to availability (C:N/I:N/A:H), meaning successful exploitation does not compromise confidentiality or integrity but can cause the affected service or device to become unresponsive or crash.

The absence of a CWE with a more specific classification (e.g., CWE-120/125/400/770) reinforces that the exact parsing flaw, the susceptible protocol, and the trigger payload are not publicly documented. No code-level detail can be responsibly stated beyond the input-validation defect class. The patch was delivered through Apple's standard security update mechanism in iOS/iPadOS 18.7.10; the "improved validation" phrasing confirms the fix adds or strengthens input checks in the affected component rather than redesigning the subsystem.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (remote improper input validation causing DoS) and the CVSS vector, not from disclosed implementation specifics.

1. Reconnaissance / Target Identification: An adversary identifies reachable Apple iOS/iPadOS devices running versions below 18.7.10. Since the attack is network-based (AV:N), the target must expose a network-facing service or protocol endpoint reachable by the attacker. Attackers may use network scanning and fingerprinting (e.g., wireless probing, service discovery, banner or protocol fingerprinting) to enumerate candidate devices. Shodan-style queries targeting Apple/iPadOS device banners or exposed services can assist in internet-facing discovery, though most affected devices reside on local or enterprise wireless networks.

2. Triggering the Flaw Class: Because the root cause is improper input validation, the attacker sends malformed, oversized, or otherwise unexpected input to the vulnerable network-facing parser. The specific protocol and payload structure are not publicly documented. At the class level, the goal is to supply input that the component fails to validate correctly, leading to resource exhaustion, an unhandled exception, or a crash. The AC:L rating implies a single or small number of crafted messages is sufficient — no race condition or complex preconditions are indicated.

3. Payload / Execution Method: At the vulnerability-class level, this is a crafted network packet or message sequence directed at the vulnerable service. No shellcode, no memory-corruption payload, and no privilege escalation is implied by the CVSS vector (no C/I impact). The attacker need not authenticate (PR:N) nor rely on victim interaction (UI:N), simplifying delivery — direct network transmission to the reachable endpoint suffices.

4. Post-Exploitation Impact: Successful exploitation degrades availability. Depending on the affected component, this could manifest as a crash of the target process, an unresponsive device, disrupted connectivity, or a reboot loop. There is no documented data exfiltration, code execution, or persistence associated with this CVE. Repeated triggering can sustain the denial-of-service condition (T1499 — Endpoint Denial of Service).

Impact Assessment

The CVSS v3.1 base score is 7.5 (HIGH), composed of AV:N (network attack vector), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), S:U (unchanged scope), C:N (no confidentiality impact), I:N (no integrity impact), and A:H (high availability impact). The blast radius is limited to availability: affected iOS/iPadOS devices running versions prior to 18.7.10 may become unresponsive or have a network-facing service disrupted. Enterprise impact includes potential loss of availability for managed iPads used in kiosks, retail, logistics, field operations, and education, as well as disruption to users relying on the affected subsystem. Because no public exploit or KEV designation exists, immediate exploitation risk is assessed as low to moderate; however, the pre-auth remote vector and HIGH severity justify expedited patching in regulated and high-availability environments. EPSS is 0.00397 (33.3rd percentile), indicating low predicted exploitation likelihood in the short term.

Detection Guidance

Sigma Rule

title: Potential Apple iOS/iPadOS Denial-of-Service Attempt (CVE-2026-28960)
id: 7c9f1a2e-4b3d-4e8a-9f21-2a6d8c5e0b77
status: experimental
description: Detects crash or unresponsiveness indicators on Apple iOS/iPadOS devices consistent with remote input-validation DoS (CVE-2026-28960). Tune to your MDM telemetry.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28960
author: valtersit.com
date: 2026-01-01
logsource:
  product: macos
  service: unified_log
detection:
  selection_crash:
    EventType: 'Crash'
    Process|contains:
      - 'SpringBoard'
      - 'backboardd'
      - 'configd'
      - 'wifid'
      - 'networkd'
  selection_mdm:
    message|contains:
      - 'device unresponsive'
      - 'repeated crash'
      - 'unexpected restart'
  timeframe: 5m
  condition: selection_crash or selection_mdm
falsepositives:
  - Legitimate application crashes unrelated to network input
  - Routine OS reboots and maintenance
level: medium
tags:
  - attack.t1499
  - cve.2026.28960

YARA Rule

rule CVE_2026_28960_iOS_InputValidation_DoS
{
    meta:
        description = "Detects iOS/iPadOS firmware or system binaries predating 18.7.10 that may be affected by CVE-2026-28960"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28960"
        date = "2026-01-01"
        cve = "CVE-2026-28960"
    strings:
        $ios = "iOS" ascii wide nocase
        $ipados = "iPadOS" ascii wide nocase
        // Build-version markers are illustrative only; validate against your own firmware inventory.
        $build_18 = "18." ascii
    condition:
        ($ios or $ipados) and $build_18
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-28960 Potential Apple iOS/iPadOS DoS Attempt - malformed input to network service"; flow:to_server,established; dsize:>1400; threshold: type both, track by_src, count 50, seconds 10; classtype:attempted-dos; reference:cve,2026-28960; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-28960; sid:202628960; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [any where event.category == "process" and process.name in ("SpringBoard","backboardd","configd","wifid","networkd") and event.action == "crash"]
  [any where event.category in ("network","process") and event.action in ("terminated","crash","restart")]

Splunk SPL Query

index=apple_logs (sourcetype=ios:unified_log OR sourcetype=mdm:telemetry)
| search (Process IN ("SpringBoard","backboardd","configd","wifid","networkd") AND (EventType="Crash" OR message="*unresponsive*" OR message="*unexpected restart*"))
| stats count values(Process) as processes values(message) as messages by host, dest_ip
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="apple,ios,ipados,denial_of_service,">
  <rule id="1028960" level="10" frequency="3" timeframe="300">
    <if_matched_sid>1028961</if_matched_sid>
    <description>CVE-2026-28960 - Multiple crash/unresponsiveness events detected on Apple iOS/iPadOS device</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_28960,</group>
  </rule>
  <rule id="1028961" level="3">
    <decoded_as>json</decoded_as>
    <field name="EventType">Crash</field>
    <description>Apple iOS/iPadOS component crash event observed</description>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations:

• Update all iOS/iPadOS devices to version 18.7.10 or later as the primary remediation.
• Until patching completes, reduce network exposure: segment managed iPads on isolated VLANs, restrict untrusted network access, and disable unnecessary network-facing services where enterprise policy permits.
• Apply MDM profiles to enforce minimum OS versions and block enrollment of unpatched devices onto sensitive segments.
• Monitor for anomalous crash/restart telemetry on the components referenced in detection rules above.

2. Patch / Upgrade Steps:

• Verify the current iOS/iPadOS version on fleet devices (Settings > General > About, or via MDM inventory).
• Deploy update to 18.7.10+ through MDM or supervised update workflows; confirm the "improved validation" fix is present in that build per the NVD reference.
• Because patch confidence is CLAIMED (single source: NVD), cross-verify the fixed version against Apple's official security advisory before closing remediation tickets.

3. Long-Term Hardening:

• Maintain automated fleet version compliance and rapid update cycles for Apple devices.
• Adopt network segmentation for mobile/kiosk devices to limit pre-auth remote reachability.
• Continuously ingest MDM and unified-log telemetry into the SIEM for proactive DoS/crash detection.
• Track CVE-2026-28960 in your vulnerability management system and monitor for any future public exploit or KEV listing that would raise priority.

References

• NVD — CVE-2026-28960: https://nvd.nist.gov/vuln/detail/CVE-2026-28960
• Apple Security Releases / Updates (iOS & iPadOS 18.7.10): https://support.apple.com/en-us/HT201222
• CWE-20: Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (currently NOT listed; verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on threat actor activity: No known threat actor campaigns, exploit-in-the-wild evidence, public PoC, Nuclei template, or exploit code are associated with CVE-2026-28960 as of this report. The vulnerability is not in CISA KEV. Attack chain details above are inferred at the vulnerability-class level only, as no implementation specifics were disclosed in the NVD description or CNA title.