An authentication flaw in Apple iOS and iPadOS allows an attacker with a privileged network position to bypass IPSec authentication, enabling interception of network traffic. The vulnerability arises from improper state management that can be exploited to override or ignore authentication checks. Successful exploitation would compromise confidentiality and potentially integrity of data travelling over the network, allowing full eavesdropping of communications.

Apple iOS and iPadOS devices that run versions prior to 26.6.1 are affected. The flaw is fixed in iOS 26.6.1 and iPadOS 26.6.1, so any device with an older OS revision remains vulnerable.

The EPSS score is <1%, and the CVSS score is 5.9, indicating a moderate severity vulnerability. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. Because an attacker must be in a privileged network position, the risk remains significant for internal or compromised networks using IPSec tunnels. No additional prerequisites are listed, so the vulnerability appears exploitable in any environment where IPSec authentication can be manipulated.