← Vulnerability feed

Vulnerability record · CVE-2023-38606 · published 27 July 2023

CVE-2023-38606: Apple kernel state management flaw allows sensitive kernel state modification

Apple · Ipados

Apple addressed a kernel state management issue across iOS, iPadOS, macOS, tvOS and watchOS. An app may be able to modify sensitive kernel state, and Apple states it is aware of a report that this issue may have been actively exploited against iOS versions released before iOS 15.7.1.

5.5 CVSS 3.1 Medium CISA KEV since 26 Jul 2023 EPSS 2.9% · top 13.6%
5.5CVSS 3.1 base score
2.9%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
5Affected product versions listed by NVD
15References
17 Jun 2026Last modified by NVD

Description

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation against older iOS versions, though the CVSS score is only 5.5 and exploitation requires local access plus user interaction.

What it is

Apple addressed a kernel state management issue across iOS, iPadOS, macOS, tvOS and watchOS. An app may be able to modify sensitive kernel state, and Apple states it is aware of a report that this issue may have been actively exploited against iOS versions released before iOS 15.7.1.

Impact

A local app can modify sensitive kernel state, which can undermine kernel integrity and potentially enable privilege escalation or bypass of platform protections. The CVSS vector rates integrity impact as High with no confidentiality or availability impact.

Attack surface

The vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the attacker needs a malicious or compromised app running on the device and some user action to trigger it. No network vector or authentication requirement is indicated.

Exploitation

Apple states the issue may have been actively exploited against iOS versions before 15.7.1, and CISA added it to the KEV catalog on 2023-07-26 with a 2023-08-16 remediation due date. EPSS 30-day probability is about 2.9 percent (86th percentile), and no ransomware campaign use is documented.

What to do

  • Update to the fixed releases: iOS 16.6, iPadOS 16.6, iOS 15.7.8, iPadOS 15.7.8, macOS Ventura 13.5, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, tvOS 16.6, watchOS 9.6.
  • Prioritize patching devices still running iOS or iPadOS versions before 15.7.1, which Apple identifies as the potentially exploited range.
  • Restrict installation of apps to trusted sources and enforce mobile device management controls to reduce exposure to malicious apps.
  • Track KEV remediation deadlines and confirm all managed Apple devices meet the 2023-08-16 due date.
  • Monitor Apple security advisories for any follow-up updates if a device cannot be patched immediately.

Detection

  • Inventory Apple devices and flag any still running iOS, iPadOS, macOS, tvOS or watchOS versions below the fixed releases.
  • Review MDM or endpoint telemetry for unexpected app behavior or kernel-level anomalies on unpatched devices.
  • Correlate device OS versions against the KEV due date to identify overdue remediation.
  • Watch for indicators tied to known exploit chains targeting pre-15.7.1 iOS, though no specific IOCs are provided in this record.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-38606 to the Known Exploited Vulnerabilities catalog on 26 July 2023 as "Apple Multiple Products Kernel Unspecified Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 16 August 2023.

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.apple.com/en-us/HT213841 Vendor Advisory
https://support.apple.com/en-us/HT213842 Vendor Advisory
https://support.apple.com/en-us/HT213843 Vendor Advisory
https://support.apple.com/en-us/HT213844 Vendor Advisory
https://support.apple.com/en-us/HT213845 Vendor Advisory
https://support.apple.com/en-us/HT213846 Vendor Advisory
https://support.apple.com/en-us/HT213848 Vendor Advisory
https://support.apple.com/en-us/HT213841 Vendor Advisory
https://support.apple.com/en-us/HT213842 Vendor Advisory
https://support.apple.com/en-us/HT213843 Vendor Advisory
https://support.apple.com/en-us/HT213844 Vendor Advisory
https://support.apple.com/en-us/HT213845 Vendor Advisory
https://support.apple.com/en-us/HT213846 Vendor Advisory
https://support.apple.com/en-us/HT213848 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38606 US Government Resource

Track CVE-2023-38606 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-43300Apple iOS, iPadOS and macOS out-of-bounds write via malicious imageAn out-of-bounds write in Apple iOS, iPadOS and macOS is triggered when processing a malicious image file, causing memory corruption. Apple states th…KEVEPSS 22%analysed10.0CVE-2025-24201Apple WebKit out-of-bounds write allows sandbox escapeCVE-2025-24201 is an out-of-bounds write in Apple's WebKit that was addressed with improved checks. Maliciously crafted web content may break out of …KEVEPSS 3.8%analysed10.0CVE-2025-24085Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS Use-After-Free Privilege EscalationA use-after-free flaw in Apple's operating systems was fixed through improved memory management in iOS 18.3, iPadOS 18.3 and 17.7.6, macOS Sequoia 15…KEVEPSS 18%analysed9.8CVE-2026-65400Apple macOS Screen Sharing authentication bypassAn improper authentication flaw in Apple macOS Screen Sharing allows a network attacker to authenticate without valid credentials. Apple fixed it via…KEVEPSS 1.2%analysed9.8CVE-2025-31200Apple OS media parsing memory corruption allows code executionA memory corruption flaw in Apple's audio stream processing was fixed with improved bounds checking across iOS, iPadOS, macOS, tvOS, visionOS and wat…KEVEPSS 19%analysed9.8CVE-2025-31201Apple OS Pointer Authentication bypass via arbitrary read/writeApple removed vulnerable code that allowed an attacker holding arbitrary read and write capability to bypass Pointer Authentication across iOS, iPadO…KEVEPSS 14%analysed9.8CVE-2022-22587Apple iOS, iPadOS and macOS kernel memory corruption via out-of-bounds writeAn out-of-bounds write (CWE-787) in Apple iOS, iPadOS and macOS is caused by insufficient input validation and can corrupt memory. Apple states it is…KEVEPSS 12%analysed9.8CVE-2021-1870Apple WebKit logic flaw allows remote code executionA logic issue in Apple's WebKit was addressed with improved restrictions, affecting macOS Big Sur, Catalina, Mojave, iOS and iPadOS, plus WebKitGTK a…KEVEPSS 7.7%analysed

Source: NIST National Vulnerability Database (record CVE-2023-38606), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.