CVE-2020-9850: Apple WebKit logic flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no privileges and no user interaction, combined with a very high EPSS score, warrants critical priority despite the absence of KEV listing.

What it is

A logic issue in Apple's WebKit and related components was fixed by tightening restrictions across iOS, iPadOS, tvOS, watchOS, Safari, iTunes for Windows and iCloud for Windows. The flaw allows a remote attacker to achieve arbitrary code execution. It matters because the affected platforms are widely deployed and the CVSS vector indicates no privileges or user interaction are required.

Impact

An attacker can execute arbitrary code in the context of the affected component, potentially leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N) per the CVSS vector. The description does not specify the exact entry point, so the precise reachable interface is not detailed in the record.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record. EPSS is high (0.77246, 99.53rd percentile), indicating a strong likelihood of exploitation activity.

What to do

• Update to the fixed versions: iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2 and 7.19.
• Inventory all Apple devices and Windows systems running iTunes or iCloud for Windows and confirm patch status against the fixed versions.
• Prioritize internet-facing and browser-related components (Safari, WebKit-based views) for immediate remediation.
• Monitor vendor advisories for any revised guidance, since the record's references are all Apple support pages.
• Restrict or segment systems that cannot be patched promptly to reduce exposure to remote code execution.

Detection

• Monitor for unexpected process creation or code execution originating from Safari, WebKit, iTunes or iCloud processes.
• Review endpoint telemetry for anomalous child processes spawned by browser or Apple update components.
• Track exploitation attempts against unpatched Apple endpoints using network and host intrusion detection signatures.
• Correlate Apple device version data with the fixed version list to identify unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.