CVE-2026-43674

CVE-2026-43674 is an authentication flaw in Apple's iOS and iPadOS caused by improper state management in the handling of sensitive settings. It is triggered when an attacker has physical access to a device that is already unlocked, allowing them to view saved Wi-Fi passwords without passing any additional authentication prompt. Successful abuse reveals stored Wi-Fi network credentials, which an attacker could reuse to join and position themselves on those networks for further attacks. The issue is fixed in iOS 27 and iPadOS 27, meaning devices running earlier releases remain exposed. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Update iPhones and iPads to iOS 27 or iPadOS 27 as soon as rollout reaches your devices, and prioritize shared or helpdesk-managed devices. Because exploitation requires physical access to an unlocked device, require immediate auto-lock with short timeouts and avoid leaving unlocked devices unattended or handing them to untrusted parties. Administrators should audit managed-device update compliance and treat leaked Wi-Fi credentials as rotatable secrets if devices were exposed.