Skip to content
Weekly Signal
Live intelligence Updated 20 Aug 2026 · 23:28 UTC

Apple, WebKitGTK · Ipados, Iphone Os, macOS +5 more

CVE-2023-37450

Apple Multiple Products WebKit Code Execution Vulnerability

Recommended action

Validate affected assets and exposure now, then remediate on an accelerated schedule. Apple Security advisory HT213826

View response plan
CVSS8.8
EPSS19.0%
KEVYes
ExploitationConfirmed exploitation
RemediationNot yet verified ↓

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 19.0%; technical severity is CVSS 8.8.

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Who should care

  • Teams operating Ipados, Iphone Os, macOS +5 more
  • Vulnerability and exposure management teams
  • Security operations teams monitoring exploitation activity

Response plan

What I would do

  1. Confirm whether Ipados, Iphone Os, macOS +5 more is present in the environment.
  2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
  3. Apple Security advisory HT213826
  4. Review relevant security telemetry for evidence of attempted or successful exploitation.
  5. Document the remediation decision and track it to verified completion.

Treatment intelligence

Remediation intelligence

Not yet verified

Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.

Verification noteAutomated link verification has not completed for this guidance yet.

Advisory

Required Action

Technical details

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
Not classified
Affected versions
Apple Ipados (End Excluding 16.6); Apple Iphone Os (End Excluding 16.6); Apple macOS (Start Including 13.0, End Excluding 13.5); Apple Multiple Products; Apple Safari (End Excluding 16.5.2); Apple Tvos (End Excluding 16.6); Apple Watchos (End Excluding 9.6); WebKitGTK WebKitGTK (End Excluding 2.42.3)
Fixed versions
Apple Ipados (Fixed from 16.6); Apple Iphone Os (Fixed from 16.6); Apple macOS (Fixed from 13.5); Apple Safari (Fixed from 16.5.2); Apple Tvos (Fixed from 16.6); Apple Watchos (Fixed from 9.6); WebKitGTK WebKitGTK (Fixed from 2.42.3)
Published
26 July 2023
Attack vector
Network
Privileges required
None
User interaction
Required

Signal timeline

  1. CVE published
  2. Added to CISA KEV
  3. Latest EPSS score: 19.0%
  4. Signal calculated at 73

External references

Live public intelligence This assessment combines public-source evidence. Validate the affected product, version and exposure against your own environment before making a risk decision.