HowToFixMe
● Medium · CVSS 4.6

How to Fix CVE-2026-28963: Visual Intelligence Data Exposure During iPhone Mirroring

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-06-15

CVE-2026-28963 is a privacy flaw in Apple iOS and iPadOS where a person who has physical hold of your device can use Visual Intelligence to reach sensitive user data while an iPhone Mirroring session is running. It is not a server bug and there is nothing to patch with apt, dnf, or PowerShell. The fix is simply updating the phone or iPad: Apple shipped the correction in iOS 26.5 and iPadOS 26.5 by removing the vulnerable code. Below I walk through checking your installed version, installing 26.5, and what to do on the lock screen if you cannot update for a day or two.

⚡ At a glance
ProductApple iOS and iPadOS
SeverityCVSS 3.1: 4.6 (Medium) · AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Actively exploited?No — not on CISA KEV; CISA SSVC Exploitation: none
Affected versionsAll iOS and iPadOS builds earlier than 26.5
Fixed iniOS 26.5 and iPadOS 26.5
Attacker requirementPhysical access to the device (no network, no privileges, no user interaction)
Type (CWE)CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Exploitation status

CVE-2026-28963 is absent from the CISA KEV catalog, and CISA's own SSVC vulnrichment scores its Exploitation state as none with Automatable set to no. That pairing makes sense for this bug: the only way to abuse it is to physically pick up someone's unlocked device while it is mirroring to a Mac, so it cannot be sprayed across the internet by a scanner or worm.

Public exploit availability: no public exploit code is linked from the Apple advisory. Because the precondition is hands-on physical access rather than a network packet, there is no Metasploit-style remote module for a flaw of this shape. Treat it as a normal-priority OS update, not a fire drill.

Authoritative reference:

What is CVE-2026-28963?

CVE-2026-28963 is a privacy issue in Apple's iOS and iPadOS operating systems. Apple describes it plainly in advisory HT127110: an attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring. The fix was made by removing the vulnerable code, and it landed in iOS 26.5 and iPadOS 26.5.

Two features matter here. iPhone Mirroring is the Continuity feature that lets you drive your iPhone from a nearby Mac, with the phone's screen and apps appearing in a window on the desktop. Visual Intelligence is Apple's on-device feature that interprets what is on the screen or in the camera view and surfaces related information and actions. The bug is in how Visual Intelligence behaved while a Mirroring session was active. Under the right conditions, the feature could be used to reach user data that should have been gated behind the normal locking and authorization that iPhone Mirroring enforces.

The flaw is categorized as CWE-359, exposure of private personal information to an unauthorized actor. There is no memory-corruption, no code execution, and no privilege escalation involved. The harm is purely confidentiality: data leaking to someone who should not see it. That is also why the CVSS vector reads C:H/I:N/A:N — high confidentiality impact, but zero impact on integrity or availability. Nothing is altered or knocked offline; information is simply disclosed.

The CVSS attack vector is Physical (AV:P). That is the single most important detail on this page. The attacker has to be holding or sitting in front of the actual device with an active mirroring session. There is no remote angle, no malicious website, no network packet, and no required user interaction beyond the attacker's own actions (PR:N, UI:N). Attack complexity is Low because once those physical preconditions are met, the technique is straightforward. The CISA SSVC assessment confirms the practical picture: Exploitation none, Automatable no, Technical Impact partial.

Why this CVE matters

At CVSS 4.6 this is a Medium-severity issue, not a critical remote hole, and the page header reflects that honestly. The reason it still deserves attention is the kind of data Visual Intelligence can surface. iPhone Mirroring is most commonly used at a desk, often a shared or office desk, and the whole point of a lock screen and per-session authorization is to keep a borrowed or briefly unattended device from spilling messages, photos, notes, and account details. A confidentiality flaw that sidesteps that boundary undercuts exactly the protection people rely on.

Who is realistically exposed? Anyone who uses iPhone Mirroring and shares physical space with people they do not fully trust: open-plan offices, families and roommates, repair counters, or any moment a device is left unlocked and mirroring while you step away. The threat actor is the person next to you, not a botnet halfway across the world. That narrows the population at risk, which is why this is a normal-priority update rather than an emergency. But for a journalist, an executive, a domestic-abuse survivor, or anyone whose phone holds genuinely sensitive material, "physical access" is not a comfortable distance — it is a Monday morning.

The honest framing: low likelihood of mass exploitation, but a real and uncomfortable failure mode for targeted situations. Updating to 26.5 closes it permanently, and there is no downside to doing so.

Am I affected?

Every iOS and iPadOS release earlier than 26.5 is affected. The fix is in iOS 26.5 and iPadOS 26.5. Checking your build takes ten seconds:

If the version shows 26.5 or higher, you already have the fix and nothing more is needed. If it shows anything lower — 26.4, 26.3, an 18.x build, or older — you are exposed and should update. You only need to worry about the Mirroring exposure if you actually use iPhone Mirroring with a Mac, but updating protects you regardless and rolls up every other fix in the 26.5 release.

How to fix CVE-2026-28963

The fix is an on-device software update. There is nothing to compile, no package manager, and no server to touch. Apple ships the corrected code in iOS 26.5 and iPadOS 26.5.

Update directly on the iPhone or iPad

  1. Plug the device into power and connect to Wi-Fi (iOS will not download a large OS update over cellular by default).
  2. Open Settings → General → Software Update.
  3. If iOS 26.5 / iPadOS 26.5 (or a later build) is offered, tap Update Now or Download and Install.
  4. Enter your passcode when prompted and let the device reboot to finish installing.

While you are there, turn on Automatic Updates (Settings → General → Software Update → Automatic Updates) so future security fixes like this one install on their own overnight.

Updating a managed fleet (MDM)

If you administer iPhones or iPads through an MDM such as Apple Business Manager with Jamf, Intune, or Kandji, push the OS update through your management console rather than walking to each device. Use the managed software update command to target the 26.5 build, and stage a small ring of test devices before the full rollout. This is purely a mobile OS update: there is no Linux package, no Windows installer, and no container image involved, so any guide pointing you at server package managers for this CVE is simply wrong.

If you can't update immediately

The update is the only real fix. Because the bug requires physical access to an unlocked, mirroring device, a handful of habits sharply cut the practical risk while you schedule the update:

These steps reduce opportunity. They do not remove the vulnerable code — only iOS 26.5 / iPadOS 26.5 does that.

How to verify the fix worked

Verification is a version check, not a scan. After the device reboots, open Settings → General → About and confirm the iOS or iPadOS version reads 26.5 or later. That single string is the proof: Apple removed the vulnerable code in that build, so a device reporting 26.5+ no longer carries the flaw.

For a managed fleet, pull the OS version inventory from your MDM dashboard and confirm every enrolled iPhone and iPad reports 26.5 or higher. Any device still below that line has not received the fix and should be nudged or force-updated. There is no log file, network probe, or vulnerability-scanner signature to run on the device itself — the reported OS build is the authoritative answer.

Frequently asked questions

Is CVE-2026-28963 being exploited in the wild?

No. It is not on CISA's KEV catalog, and CISA's SSVC assessment records Exploitation as none and Automatable as no. Exploitation requires hands-on physical access to an unlocked iPhone during an active Mirroring session, so it cannot be carried out remotely or at scale. Update to iOS 26.5 / iPadOS 26.5 on your normal schedule.

What is the CVSS score, and how would someone actually exploit this?

The CVSS 3.1 base score is 4.6 (Medium), vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The Physical attack vector means an attacker must have their hands on your device. During an active iPhone Mirroring session, they could use Visual Intelligence to view sensitive user data. There is no network, web, or wireless path.

Which version fixes CVE-2026-28963?

Apple fixed it in iOS 26.5 and iPadOS 26.5 by removing the vulnerable code. Any build earlier than 26.5 is affected. Install 26.5 or later through Settings → General → Software Update.

Can a firewall, VPN, or MDM policy mitigate this instead of updating?

Network controls do nothing here because the flaw is a physical-access privacy issue, not a network bug. The only durable fix is updating to 26.5. Until then, a strong passcode, Face ID or Touch ID, a short auto-lock, and quitting iPhone Mirroring when you are not using it cut the practical risk.

Other CVEs touching related code paths, worth patching together with this one:

References

Compiled from Apple's security advisory and the CISA ADP vulnrichment record (CVSS, CWE, and SSVC data) for CVE-2026-28963. This CVE is not listed in the CISA KEV catalog. Always confirm your device version against Settings → General → About.