CVE-2026-43674

Executive Summary

CVE-2026-43674 is an authentication bypass in Apple iOS and iPadOS affecting versions prior to iOS 27 and iPadOS 27. The flaw results from inadequate state management in an authentication flow, and an attacker with physical access to an unlocked device may be able to view stored Wi-Fi passwords without completing authentication. The primary risk is credential disclosure to a local adversary who already holds the unlocked handset; impact is limited to confidentiality (no integrity or availability impact), and no public exploit, PoC, or Nuclei template is currently available.

Technical Analysis

The NVD description states: "An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication."

From this we can derive the following verified facts, and nothing more:

1. Class: Improper Authentication (CWE-287). A security-relevant authentication decision is made incorrectly, allowing access to a protected resource without establishing the required authentication state.
2. Root cause category: "Improved state management" indicates the flaw is in how the software tracks authentication/session state — i.e., a protected screen or data view could be reached while the system's state did not (or did not correctly) record that authentication was required. This is characteristic of UI state / view-controller gating failures in which the code path that should require a device passcode or credential entry is bypassable or skipped.
3. Attack surface: The Wi-Fi password disclosure UI within Settings-equivalent system interfaces. The resource is a locally stored credential (a saved Wi-Fi network password).
4. Precondition: Physical access to an unlocked device. The attacker does not need to know the passcode; the device is already unlocked. This sharply constrains the threat model — the flaw does not grant code execution, persistence, or remote access.
5. Exposure: Confidentiality-only. No integrity or availability impact is implied.

Insufficient technical detail available to identify specific methods, view controllers, entitlements, or code paths. The NVD entry does not name functions, classes, or files, so this report deliberately does not invent them. Nuclei, OSV, and exploit feeds report no matching artifacts.

Notably, the authentication this bug bypasses is the re-authentication step normally required before revealing Wi-Fi credentials — not the device unlock itself. Because the device must already be unlocked, the practical security delta is "someone holding your phone can extract a saved Wi-Fi PSK" rather than "someone can unlock your phone."

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class (improper authentication via weak state management) and the explicit precondition in the NVD description. Concrete UI paths, action names, or method invocations are not specified in the source data and are therefore not fabricated here.

1. Reconnaissance / target identification. The attacker must have physical possession or momentary control of a device that is already unlocked. There is no remote reconnaissance phase: an adversary cannot enumerate targets over a network for this flaw. In a real-world scenario this is a shoulder-surfing / borrowed-device / lost-and-found-while-unlocked scenario, or a "trusted insider with brief unattended access" scenario.

2. Triggering the flaw (vulnerability-class level). The attacker navigates to the system settings interface where saved Wi-Fi network credentials are displayed. Under normal operation, viewing a stored Wi-Fi password requires a successful authentication step (device passcode or biometrics). For CVE-2026-43674, the authentication state governing that gate is mishandled — the improved-state-management fix implies the application failed to correctly require/transition authentication state before rendering the credential. Consequently, the protected value is disclosed without the authentication prompt completing.

3. Payload / execution method. There is no payload in the classic sense. The "capability" is the ability to invoke the credential-viewing UI and read the resulting plaintext Wi-Fi password. The exploit is a sequence of user-interface interactions performed on an unlocked, unmodified device — it requires no jailbreak, no sideloaded app, and no memory corruption primitive, per the authentication-issue classification.

4. Post-exploitation impact. The attacker obtains the cleartext PSK for one or more saved Wi-Fi networks. This credential enables:

   • Joining the same (potentially corporate/enterprise) Wi-Fi network from an attacker-controlled device,
   • Pivoting into flat networks reachable from that Wi-Fi segment,
   • Recovering a password that users frequently reuse for other services.

   There is no persistence, lateral movement on the device, code execution, or privilege escalation implied by the description. The impact terminates at confidentiality of saved wireless credentials.

Constraints and caveats. If the device is locked, this precondition is not met and the described scenario does not apply. If Wi-Fi password viewing is itself gated behind an additional re-auth that is also subject to the same state flaw, the number of networks exposed depends on implementation detail not present in the source data.

Impact Assessment

• Affected systems: iPhone and iPad devices running iOS or iPadOS versions prior to 27. Exact vulnerable version range is not enumerated in the provided data (Affected Versions: []), so treat "before iOS 27 / iPadOS 27" as the working bound.
• Blast radius: Local, single-device. No server-side or multi-tenant impact.
• CVSS reasoning (vector provided as an inferred rating): AV:P (physical) / AC:L (no special conditions beyond the described precondition) / PR:N (no privileges — device is unlocked) / UI:N (no victim interaction beyond the attacker's own) / S:U / C:H / I:N / A:N. The NVD record provides no official CVSS score (CVSS Score: N/A), so the vector above is analyst-derived and should be treated as provisional until Apple publishes a severity rating.
• EPSS: 0.00207 (11.1th percentile). This is low, consistent with a physical-access, no-public-exploit defect. There is a possible but low near-term exploitation likelihood at scale.
• CISA KEV: Not listed. No known exploitation in the wild.
• Business impact: Most acute for organizations issuing iPhones/iPads to staff that connect to WPA2/WPA3-Enterprise or pre-shared corporate Wi-Fi. Disclosure of a PSK can enable an attacker to join the corporate wireless network if they also obtain physical access to an unlocked managed device — a realistic risk in high-turnover, retail, healthcare, and field-service environments.
• Reputational/regulatory: Because stored Wi-Fi credentials can be corporate assets, disclosure may implicate data-protection obligations, though the practical severity is moderate.

Detection Guidance

Note: This is a local, physical-access vulnerability. Network detection (Suricata, EQL network telemetry) has limited applicability, and detections below are oriented toward mobile device management (MDM), EDR/MDM telemetry, and post-hoc auditing. Rules are provided as building blocks and should be tuned to your environment.

Sigma Rule

title: Potential Wi-Fi Credential Disclosure via Authentication State Bypass (CVE-2026-43674)
id: 8f3c1e02-4b7a-4c2d-9e10-aa12b3c4d5e6
status: experimental
description: Detects access to Wi-Fi password disclosure UI on Apple iOS/iPadOS devices, which may indicate exploitation of CVE-2026-43674 (authentication bypass).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-43674
author: ValtersIT Threat Intel
date: 2026-01-01
tags:
  - attack.t1078
  - attack.t1555
logsource:
  product: apple
  service: ios
detection:
  selection_ui:
    event.action: 'wifi_password_viewed'
  selection_unauth:
    authentication.state: 'unauthenticated'
  condition: selection_ui and selection_unauth
falsepositives:
  - Legitimate user reviewing their own Wi-Fi password after successful device unlock
level: medium

Apply this only where MDM/EDR telemetry surfaces a wifi_password_viewed-style event with an accompanying authentication-state field. If your telemetry lacks such fields, this rule cannot fire — refer to the audit-based guidance below.

YARA Rule

rule AUTH_STATE_BYPASS_WIFI_CREDENTIAL_DISCLOSURE_CVE_2026_43674
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Heuristic match for artifacts referencing the CVE-2026-43674 Wi-Fi credential disclosure issue in iOS/iPadOS builds. Generic/high-FP; use for research pivoting only."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-43674"
        date = "2026-01-01"
        severity = "informational"
        tlp = "CLEAR"

    strings:
        $cve  = "CVE-2026-43674" ascii wide nocase
        $t1   = "Wi-Fi password" ascii wide nocase
        $t2   = "WiFi password" ascii wide nocase
        $t3   = "authentication state" ascii wide nocase
        $t4   = "improved state management" ascii wide nocase nocase

    condition:
        uint32(0) == 0xFEEDFACE or uint32(0) == 0xCAFEBABE or true
}

This rule intentionally looks for descriptive strings and the CVE identifier. It is designed for scanning build metadata, notes, MDM payloads, or documentation referencing this issue — not for byte-precise matching of the vulnerability itself, which would require symbols not present in the source data.

Suricata IDS Rule

alert ip any any -> any any (msg:"LOCAL-CVE-2026-43674 Possible Wi-Fi Credential Disclosure Activity (local/opportunistic)"; \
    flow:to_server; \
    content:"CVE-2026-43674"; nocase; \
    classtype:attempted-recon; \
    sid:9004367; rev:1; \
    metadata:created_at 2026, cve CVE-2026-43674, confidence Low;)

Network detection is a poor fit for a local physical-access authentication bypass. This rule will fire only if the CVE identifier appears on the wire (e.g., vulnerability-scanner traffic or ticketing references). Use it as a low-confidence capture aid for research, not as a reliable exploit detector.

Elastic Detection

//
// Elastic EQL — UI authentication state variant access on Apple iOS/iPadOS
// Detects the disclosure of a saved Wi-Fi password while authentication state is not established.
//
sequence by device.id with maxspan=5m
  [ any where event.category == "process" and process.name == "SpringBoard" ]
  [ any where event.action == "wifi_password_viewed" and authentication.state == "unauthenticated" ]

Requires iOS MDM/EDR telemetry that emits a Wi-Fi credential-viewed event with an authentication state attribute. If your fleet does not forward such telemetry, substitute with an MDM compliance/audit log join.

Splunk SPL Query

index=apple_mdm OR index=mobile_security
(
  event_type="wifi_credential_view"
  OR action="wifi_password_viewed"
  OR "Wi-Fi password" 
)
AND
(
  authentication_state="unauthenticated"
  OR auth_state!="authenticated"
)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(authentication_state) as auth_states
        values(device.id) as device_ids
        by user, device_model, os_version
| where first_seen > (now() - 86400)
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S")
| eval last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

If MDM logs do not carry Wi-Fi-password-view events (most do not today), pivot to an audit query over MDM enrollment/credential-rotation logs and correlate any unusual Wi-Fi credential rotation for users who may have lent out devices.

Wazuh OSSEC Rule

<group name="apple,ios,authentication,">
  <rule id="100674" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">^wifi_password_viewed$</field>
    <field name="authentication.state">^unauthenticated$</field>
    <description>Possible exploitation of CVE-2026-43674: Wi-Fi password viewed without authentication on iOS/iPadOS device.</description>
    <mitre>
      <id>T1078</id>
      <id>T1555</id>
    </mitre>
    <group>authentication_bypass,cve_2026_43674,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. The NVD description states the issue is "fixed in iOS 27 and iPadOS 27." This is a single-source claim that has not been independently confirmed by a retrieved vendor advisory in this dataset. Verify against Apple's official security notes and support pages before relying on the fix, and confirm that a corresponding security update identifier exists for your device models.

1) Immediate mitigations (pre-patch / unpatchable devices)

• Keep devices locked when not in active use and enforce short auto-lock and strong alphanumeric passcodes via MDM.
• Restrict physical access to managed mobile devices; enforce asset custody and checkout procedures for high-risk roles.
• Treat saved Wi-Fi credentials as potentially exposed: rotate pre-shared keys / WPA2-Enterprise credentials on networks accessible from managed devices where there is elevated risk of physical access.
• Where feasible, disable or restrict on-device display of saved Wi-Fi passwords via MDM configuration profile if Apple exposes such a restriction (verify availability for your OS baseline).
• Compensating control: monitor for anomalous joining of internal Wi-Fi networks from unknown devices (802.1X / NAC logs) — because a leaked PSK enables exactly this pivot.

2) Patch / upgrade steps

• Upgrade all affected iPhone and iPad devices to iOS 27 / iPadOS 27 (or later).
• Use MDM to push the pending OS update and enforce a compliance deadline; report non-compliant devices.
• After update, confirm the security note for iOS 27 / iPadOS 27 lists CVE-2026-43674 and records the change as "improved state management."
• For devices that cannot be updated (out-of-support hardware), apply the mitigations above and document the residual risk / consider replacement.

3) Long-term hardening

• Enforce a MDM baseline that (a) requires current OS versions, (b) enforces strong device passcodes, and (c) applies auth/re-auth policy to sensitive settings panes.
• Adopt a Windows-style "secure enclave" expectation for credential viewing: any UI that displays plaintext secrets should require a fresh authentication (passcode/biometric), with the state transition logged.
• Maintain 802.1X/NAC + wireless anomaly detection so a leaked PSK is quickly detectable through its use, not just through the initial disclosure.
• Standardize on credential rotation for Wi-Fi PSKs shared to mobile devices, and prefer WPA2/WPA3-Enterprise with per-user certs to reduce the blast radius of any single PSK disclosure.
• Subscribe to Apple security notes and to NVD; re-verify this CVE's status once a first-party Apple advisory is published (patch confidence should move from 2/4 to confirmed upon independent verification).

References

1. NVD — CVE-2026-43674: https://nvd.nist.gov/vuln/detail/CVE-2026-43674
2. CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
3. MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. MITRE ATT&CK — T1555 Credentials from Password Stores: https://attack.mitre.org/techniques/T1555/
5. Apple Security Releases (verify the iOS 27 / iPadOS 27 security note for CVE-2026-43674): https://support.apple.com/en-us/HT201222

Threat-actor / exploit-in-the-wild status: None. EPSS 0.00207; not in CISA KEV; no public PoC, exploit code, or Nuclei template identified. Treat exploitation as opportunistic and local (attacker with temporary physical access to an already-unlocked device) rather than as a targeted remote campaign. This assessment should be revisited if an Apple advisory, PoC, or wild-exploitation report is published.