High 8.8Known exploited (CISA KEV)Published Sep 21, 2023

CVE-2023-41993The issue was addressed with improved checks.

Updated under an hour ago (Oct 28, 2026, 3:10 AM ET)

Does this affect you?

It affects Apple macOS and 14 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Sep 25, 2023; federal agencies had to remediate by Oct 16, 2023. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apple macOS

Exploited in the last 30 days

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS: 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-754
Known exploited: Added to CISA KEV Sep 25, 2023; federal remediation due Oct 16, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 24.35% (percentile 98)
Assigned by: apple
NVD analysis: Analyzed
Record last updated: Nov 4, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apple macOS apple:macos (from the name)	from unspecified before 14	CNA record
apple iphone_os apple:iphone_os	before 17.0.1	CISA ADP
apple ipad_os apple:ipad_os	before 17.0.1	CISA ADP
apple macos apple:macos	before 14.0	CISA ADP
fedoraproject fedora fedoraproject:fedora	37	CISA ADP
debian debian_linux debian:debian_linux	11.0; 12.0	CISA ADP
oracle graalvm oracle:graalvm	20.3.13	CISA ADP
oracle jdk oracle:jdk	1.8.0	CISA ADP
oracle jre oracle:jre	1.8.0	CISA ADP
netapp cloud_insights_acquisition_unit netapp:cloud_insights_acquisition_unit	all versions	CISA ADP
1–10 of 27

References

References

https://support.apple.com/en-us/HT213940	vendor-advisory
https://security.gentoo.org/glsa/202401-33	third-party-advisory
https://security.netapp.com/advisory/ntap-20240426-0004/	third-party-advisory
https://support.apple.com/kb/HT213926	vendor-advisory
https://support.apple.com/kb/HT213930	vendor-advisory
https://webkitgtk.org/security/WSA-2023-0009.html	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.