An authentication flaw in Apple iOS and iPadOS allows an attacker with a privileged network position to bypass IPSec authentication, enabling interception of network traffic. The vulnerability arises from improper state management that can be exploited to override or ignore authentication checks. Successful exploitation would compromise confidentiality and potentially integrity of data travelling over the network, allowing full eavesdropping of communications.

Apple iOS and iPadOS devices that run versions prior to 26.6.1 are affected. The flaw is fixed in iOS 26.6.1 and iPadOS 26.6.1, so any device with an older OS revision remains vulnerable.

The exploit probability score is not available and the flaw is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. Nevertheless, because an attacker must be in a privileged network position, the risk is significant for internal or compromised networks that use IPSec tunnels. No additional prerequisites are listed, so the vulnerability appears exploitable in any environment where IPSec authentication can be manipulated.