An attacker who has physical access to an Apple phone or tablet could circumvent the Stolen Device Protection feature, making it possible for a stolen device to be fully operational. The vulnerability arises from missing safeguards that were added in a later update, allowing the authentication requirement to be bypassed. The weakness corresponds to CWE‑288, an authentication failure that undermines device security integrity.

Apple’s iOS and iPadOS operating systems are affected. Devices running any version prior to the combined 26.1 release lack the protective logic and are vulnerable. Apple addressed the issue in iOS 26.1 and iPadOS 26.1.

The CVSS score of 4.6 indicates a moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires physical possession of the device, the anticipated attack vector is a local, in‑person compromise rather than remote.