A path handling flaw allows a user with physical access to an iOS or iPadOS device to bypass Activation Lock, effectively granting unauthorized ownership and access to device data. The weakness corresponds to improper privilege control (CWE‑284).

Apple iOS and iPadOS devices running versions older than iOS 18.7.7 or iOS 26.2, and iPadOS 18.7.7 or iPadOS 26.2 are affected; the vulnerability is fixed in those and later releases.

The issue scores a CVSS of 6.8, indicating moderate severity, and an EPSS of less than 1%, suggesting low current exploitation probability. While not listed in CISA’s KEV catalog, the requirement for physical access limits remote threat but still poses significant risk to device owners and personal data if an adversary obtains the device.