Executive brief
iOS and iPadOS use IPSec to establish secure VPN and corporate network connections. A flaw in how these devices manage authentication state allows an attacker positioned on the network to bypass IPSec authentication checks and intercept traffic intended to be encrypted, potentially exposing corporate data and user communications.
Technical details
The vulnerability is an authentication bypass in the Telephony framework affecting IPSec (Internet Protocol Security) authentication on iOS and iPadOS. The root cause is an authentication issue tied to improper state management, allowing an attacker in a privileged network position (adjacent network) to bypass IPSec authentication mechanisms. An attacker exploiting this flaw can intercept and read network traffic that should be protected by the IPSec tunnel. The attack requires network-level access but no user interaction. Patches are available in iOS 26.6.1, iPadOS 26.6.1, iOS 27, and iPadOS 27, released August 17 and September 14, 2026.
Affected products
- Apple iOS before 26.6.1; before 27
- Apple iPadOS before 26.6.1; before 27
Timeline
- 2026-08-17: patched: Fixed in iOS 26.6.1 and iPadOS 26.6.1
- 2026-09-14: patched: Fixed in iOS 27 and iPadOS 27
- 2026-08-17: disclosed