Apple iOS and iPadOS known exploited vulnerabilities, ranked
CISA lists 5 Apple iOS and iPadOS CVEs as exploited in the wild. 1 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2025-24200: EPSS 4.5%, added 2025-02-12
- CVE-2021-30983: EPSS 2.9%, added 2022-06-27
- CVE-2023-41974: EPSS 1.9%, added 2026-03-05
- CVE-2022-42827: EPSS 1.0%, added 2022-10-25
- CVE-2023-42824: EPSS 0.9%, added 2023-10-05
All 5 Apple iOS and iPadOS CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-24200 | iOS and iPadOS Incorrect Authorization | 4.5% | – | 2025-02-12 | 2025-03-05 |
| 2 | CVE-2021-30983 | iOS and iPadOS Buffer Overflow | 2.9% | – | 2022-06-27 | 2022-07-18 |
| 3 | CVE-2023-41974 | iOS and iPadOS Use-After-Free | 1.9% | – | 2026-03-05 | 2026-03-26 |
| 4 | CVE-2022-42827 | iOS and iPadOS Out-of-Bounds Write | 1.0% | – | 2022-10-25 | 2022-11-15 |
| 5 | CVE-2023-42824 | iOS and iPadOS Kernel Privilege Escalation | 0.9% | – | 2023-10-05 | 2023-10-26 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Apple KEV CVEs · other Apple products: Multiple Products · macOS · iOS, iPadOS, and macOS · iOS · free KEV badge for Apple · all vendors