Apple iOS known exploited vulnerabilities, ranked
CISA lists 8 Apple iOS CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2016-4657: EPSS 66.8%, added 2022-05-24
- CVE-2016-4655: EPSS 33.4%, added 2022-05-24
- CVE-2016-4656: EPSS 23.6%, added 2022-05-24
- CVE-2021-30762: EPSS 11.0%, added 2021-11-03
- CVE-2021-30761: EPSS 10.5%, added 2021-11-03
All 8 Apple iOS CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2016-4657 | iOS Webkit Memory Corruption | 66.8% | – | 2022-05-24 | 2022-06-14 |
| 2 | CVE-2016-4655 | iOS Information Disclosure | 33.4% | – | 2022-05-24 | 2022-06-14 |
| 3 | CVE-2016-4656 | iOS Memory Corruption | 23.6% | – | 2022-05-24 | 2022-06-14 |
| 4 | CVE-2021-30762 | iOS WebKit Use-After-Free | 11.0% | – | 2021-11-03 | 2021-11-17 |
| 5 | CVE-2021-30761 | iOS WebKit Memory Corruption | 10.5% | – | 2021-11-03 | 2021-11-17 |
| 6 | CVE-2022-42856 | iOS Type Confusion | 8.5% | – | 2022-12-14 | 2023-01-04 |
| 7 | CVE-2019-7287 | iOS Memory Corruption | 4.6% | – | 2022-05-23 | 2022-06-13 |
| 8 | CVE-2021-30666 | iOS WebKit Buffer Overflow | 3.0% | – | 2021-11-03 | 2021-11-17 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Apple KEV CVEs · other Apple products: Multiple Products · macOS · iOS and iPadOS · iOS, iPadOS, and macOS · free KEV badge for Apple · all vendors