A critical path traversal vulnerability in Apple iOS and iPadOS enables unauthorized file system access for attackers with physical access to a trust-paired device.

This is a path traversal vulnerability where insufficient path validation allows an attacker to interact with the file system. The attack requires the user to have physical access to a device that has already been trust-paired with the attacker's hardware.

The ability to read and write arbitrary files presents a significant risk to data confidentiality and device integrity. Successful exploitation could allow an attacker to exfiltrate sensitive user data, modify system configurations, or inject malicious content, potentially leading to a full compromise of the device state. Given the high CVSS score of 7.5, organizations must treat this as a serious threat to mobile fleet security.

Immediate Action: Update all managed Apple devices to iOS or iPadOS version 26.7 or 27 immediately to apply the vendor-provided patch for path validation.

Proactive Monitoring: Review device management logs for unauthorized pairing attempts or unusual file access patterns occurring shortly after device synchronization.

Compensating Controls: Enforce strict physical security protocols for mobile devices and disable the ability to trust new devices via Mobile Device Management (MDM) policies where possible to limit the attack surface.

Public Exploit Available: No.

The severity of this vulnerability necessitates a swift patching cycle across all mobile endpoints. IT administrators should prioritize the deployment of the 26.7 or 27 update to ensure that path validation is correctly enforced, thereby neutralizing the risk of unauthorized file system interaction.