A critical state management vulnerability in Apple iOS and iPadOS could result in devices failing to lock, leading to unauthorized access to device data.

The vulnerability stems from improper state management within the operating system, which allows an unauthenticated attacker or a local user to cause a device to persistently fail to lock.

The inability for a device to lock effectively bypasses primary security controls intended to protect sensitive user data. Given the CVSS score of 7.5, this is considered a high severity issue: failure to lock allows unauthorized individuals with physical access to interact with the device, potentially leading to significant data compromise and loss of privacy.

Immediate Action: Update all affected iOS and iPadOS devices to version 18.7.2 or 26.1 immediately to apply the necessary state management fixes.

Proactive Monitoring: Security teams should monitor device management logs for unusual patterns of failed locks or persistent screen-on events across managed fleets.

Compensating Controls: Ensure that additional layers of security, such as requiring biometric or passcode authentication for sensitive applications, are enabled while the update process is underway.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a high risk to data confidentiality by undermining the device lock mechanism. Administrators must prioritize the deployment of the provided patches to Apple iOS and iPadOS devices to ensure that state management is correctly enforced and device integrity is restored.