CVE-2020-27932: Apple XNU kernel type confusion allows kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed exploitation and yields kernel code execution, but it requires local access and user interaction, lowering the practical attack bar compared with remote flaws.

What it is

A type confusion flaw in Apple's XNU kernel was fixed through improved state handling across macOS, iOS, iPadOS, watchOS, iCloud and iTunes. A malicious application can trigger it to run arbitrary code with kernel privileges, which is a full system compromise on affected devices.

Impact

An attacker who gets a malicious app running on the device gains kernel-level code execution, breaking the platform's core security boundary and enabling persistent control.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), so the attacker must already have code running on the device and convince the user to trigger it. It is not remotely reachable.

Exploitation

CVE-2020-27932 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating real-world exploitation, and EPSS puts 30-day exploitation probability at roughly 10.3 percent (95th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor updates listed in Apple's advisories (macOS Big Sur 11.0.1, iOS/iPadOS 14.2, iOS 12.4.9, watchOS 7.1/6.2.9/5.3.9, Security Update 2020-006 for High Sierra and Mojave, macOS Catalina 10.15.7 updates) as the first action.
• Enforce a minimum OS version baseline so devices below the fixed releases are flagged and upgraded.
• Restrict app installation to trusted sources and review mobile device management policies that allow sideloading or untrusted enterprise apps.
• Monitor for and remove suspicious or unmanaged applications on managed Apple devices.
• Track CISA KEV remediation deadlines for any remaining unpatched assets.

Detection

• Alert on unexpected kernel panics or crashes on Apple endpoints, which can accompany type confusion exploitation attempts.
• Monitor for processes attempting to load unsigned or unusual kernel extensions and for abnormal privilege escalation events.
• Use EDR telemetry to flag applications spawning with kernel-level activity outside normal signed software behavior.
• Audit installed OS versions against the fixed releases to find unpatched devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.