Description
A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.
Published: 2026-09-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

A remote attacker may trigger a service crash by sending input that is not properly validated. The CVE description does not detail the precise form of the input, but it is inferred the service reboot or become unusable, compromising device availability.

Affected Systems

All Apple iOS and iPadOS devices running a version earlier than 18.7.10 are affected. The issue is resolved in iOS 18.7.10 and iPadOS 18.7.10, so any device still on an earlier release is at risk.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. With an EPSS score of < 1% and the likelihood of exploitation is very low, although the potential impact on device availability is significant. It is inferred that the vulnerability can be triggered remotely, though the specific attack vector is not disclosed; remote access to the device appears sufficient to exploit the flaw.

Generated by OpenCVE AI on September 17, 2026 at 20:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to iOS 18.7.10 or iPadOS 18.7.10 to apply the input validation fix.
  • If an upgrade is not immediately possible, consider limiting exposed services or traffic that interacts with the vulnerable component.
  • Monitor device logs for repeated crashes or restarts, and isolate affected devices from critical workloads until a patch is applied.

Generated by OpenCVE AI on September 17, 2026 at 20:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/148287 cve-icon cve-icon
History

Thu, 17 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Improper Input Validation in iOS/iPadOS 18.7.x

Wed, 16 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Apple iOS and iPadOS

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Tue, 15 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Input Validation in Apple iOS and iPadOS

Mon, 14 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Vendors & Products Apple
Apple ios And Ipados

Mon, 14 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T22:54:48.376Z

Reserved: 2026-03-03T16:36:03.991Z

Link: CVE-2026-28960

cve-icon Vulnrichment

Updated: 2026-09-14T22:54:31.072Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:05.823

Modified: 2026-09-15T19:25:52.087

Link: CVE-2026-28960

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T22:00:16Z

Weaknesses
  • CWE-20

    Improper Input Validation