HOMEVULNERABILITIESCVE-2023-38606
HIGHCISA KEVIN THE WILD

CVE-2023-38606

Published: July 26, 2023

EPSS:0.10%probability of exploitation in 30 daysPercentile:27.0th

Official Description

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

NVD Source

CISA KEV Advisory

Apple Multiple Products Kernel Unspecified Vulnerability

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

Added to KEV: 2023-07-26Federal patch deadline: 2023-08-16
Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

An unspecified vulnerability in Apple iOS, iPadOS, macOS, tvOS, and watchOS allows an application to modify a sensitive kernel state. Its inclusion in CISA's KEV catalog and active exploitation make it a critical vulnerability, despite a low EPSS score.

This vulnerability is actively exploited in the wild and is included in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming its use in real-world attacks.

Recommended Action

Apple users should apply the latest security updates to their iOS, iPadOS, macOS, tvOS, and watchOS devices to address this kernel state modification vulnerability.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-38606 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-38606 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

Affected Vendors & Products

Mentioned vendors (from description):
Apple
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2023-38606

Coruna: the framework used in Operation Triangulation
Securelist (Kaspersky)· Mar 26, 2026

Kaspersky GReAT experts look into the Coruna exploit kit targeting iPhones. We discovered that the kernel exploit for CVE-2023-32434 and CVE-2023-38606 is an updated version of the Operation Triangulation exploit. [xlite_meta score:41 src:Securelist (Kaspersky) xlite_fp:2565ebde2c42a5ddd97bb8badc3c0bb920adf1f2c1043794d867e793a643a8c2]

All References (2)

→
https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848
→
https://nvd.nist.gov/vuln/detail/CVE-2023-38606

Quick Facts

CVE IDCVE-2023-38606
SeverityHIGH
CISA KEVYES — Active Exploitation
ExploitIN THE WILD
EPSS (30d)0.10%
PublishedJul 26, 2023

Known Threat Actors

core
financial

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2023-38606 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
  • !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
  • !Active exploitation confirmed — treat as P1
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2023-38606·NVD