CVE-2023-38606
KEVApple Multiple Products Kernel Unspecified Vulnerability
Description
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NPublishedJul 27, 2023
Last modifiedJun 17, 2026
Added to KEVJul 26, 2023
Remediation dueAug 16, 2023
References
- support.apple.com/en-us/HT213841Vendor Advisory
- support.apple.com/en-us/HT213842Vendor Advisory
- support.apple.com/en-us/HT213843Vendor Advisory
- support.apple.com/en-us/HT213844Vendor Advisory
- support.apple.com/en-us/HT213845Vendor Advisory
- support.apple.com/en-us/HT213846Vendor Advisory
- support.apple.com/en-us/HT213848Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38606US Government Resource
0 recent articles mention this CVE
58
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1169 days
- CVSS
- 5.5 MEDIUM
- EPSS (30-day exploit probability)
- 2.9% · top 13% of all CVEs
- Weakness
- NVD-CWE-noinfo
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.