CVE
CVE-2023-41993
- First Reported
- Mar 11, 2025
- Latest Reported
- Mar 11, 2025
CVE Enrichment
- CVSS
- 8.8 HIGH
- EPSS
- 24.35%
- EPSS Percentile
- 97.85%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- product-security@apple.com
- Published
- 22-Sep-2023 02:15
- Last Modified
- 17-Jun-2026 13:23
- EPSS Date
- 2026-10-16
- CWE
- CWE-754
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:R /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2023-09-25
- Remediation Due
- 2023-10-16
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Notes
- https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930; https://nvd.nist.gov/vuln/detail/CVE-2023-41993
Affected Products / Versions
- apple / ipados
Version / affected range: * · before (exclusive) 17.0.1
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - apple / iphone_os
Version / affected range: * · before (exclusive) 17.0.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - apple / macos
Version / affected range: * · before (exclusive) 14.0
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* - fedoraproject / fedora
Version / affected range: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* - oracle / graalvm
Version / affected range: 20.3.13
cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:* - oracle / graalvm
Version / affected range: 21.3.9
cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:* - oracle / jdk
Version / affected range: 1.8.0
cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:* - oracle / jre
Version / affected range: 1.8.0
cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* - netapp / cloud_insights_acquisition_unit
Version / affected range: -
cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:* - netapp / cloud_insights_storage_workload_security_agent
Version / affected range: -
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* - netapp / oncommand_insight
Version / affected range: -
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* - netapp / oncommand_workflow_automation
Version / affected range: -
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* - webkitgtk / webkitgtk\+
Version / affected range: * · before (exclusive) 2.42.2
cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads. Zero-Day Vulnerabilities: How They Work, Notable Attacks and Ways to Reduce Risk
CVE (3)
Malware (3)
Vendors (2)
Products (1)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.