Is CVE-2023-28206 (Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-28206 to its Known Exploited Vulnerabilities catalogue on 10 April 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.

What the KEV listing means for this CVE

CISA’s KEV catalog is the practical signal that matters here: this CVE is not just a theoretical weakness, it is one CISA has judged to be under active exploitation. For Apple environments, that means exposure should be treated as time-sensitive and operationally real, with patching and verification driven by the KEV entry rather than by ordinary maintenance cadence.

Because the flaw sits in IOSurfaceAccelerator and can let an app execute code with kernel privileges, the concern is broader than a single vulnerable app. Once a kernel-level condition is reachable, the security boundary on the device is materially weakened and defenders should assume the issue can be used for full device compromise if the vulnerable build remains in use.

How to confirm whether you are exposed

Start by identifying every iPhone, iPad, and Mac that can still run the affected Apple software line and every fleet segment where update enforcement is delayed. If you manage mobile and laptop estates separately, do not assume the mobile program already covers the desktop fleet, or vice versa. The practical question is not whether the CVE exists in abstract, but whether any active device can still accept the vulnerable code path.

For external validation and prioritisation, use the official records rather than secondary summaries: the CISA Known Exploited Vulnerabilities Catalog, the CVE Program, and the NIST National Vulnerability Database. Those sources help you confirm the record, track the official identifier, and anchor your internal remediation workflow.

Why active exploitation changes the response

Exploit-in-the-wild status changes the decision threshold. You should assume opportunistic targeting, short patch windows, and that any internet-facing or high-value device class may be targeted before normal change cycles complete. When an exploit gives kernel-level execution on a user device, the likely abuse path is not limited to a crash or one-off app failure, it can become a foothold for persistence, credential capture, or follow-on payload delivery.

That is why CISA KEV entries are used as prioritisation inputs in vulnerability management, not as informational footnotes. A KEV-listed issue should move to the front of patch queues, exception review, and exposure verification, especially where the affected platform is widely deployed or tied to privileged user workflows.

Risk and Threat Considerations

Active exploitation of a mobile or desktop OS kernel flaw creates a direct pathway from a single vulnerable device to broader organisational exposure. If attackers gain code execution with kernel privileges, they may be able to bypass local protections, tamper with security controls, and access data or sessions that were assumed to be isolated.

Failure mechanism: An attacker or malicious app reaches the vulnerable IOSurfaceAccelerator code path and uses the out-of-bounds write to execute code with kernel privileges, turning a user-level foothold into system-level compromise.

Impact: The device may be exposed to full compromise, including data theft, persistence, and further abuse of trusted access paths that depend on the integrity of the endpoint.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid exposure tracking and remediation prioritisation.
Recommendation — Prioritise and verify remediation of KEV-listed Apple devices before normal patch cycles.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	Exposure confirmation depends on knowing which Apple assets remain vulnerable.
	PR.IP-12 — A vulnerability management plan is implemented	Active exploitation makes structured prioritisation and exception handling essential.
Recommendation — Identify every affected Apple endpoint and document update status across the fleet. Escalate this CVE into your highest-priority remediation path and track exceptions tightly.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV status and vulnerable-device discovery both rely on continuous vulnerability monitoring.
	SI-2 — Flaw Remediation	This CVE requires prompt correction, not deferred maintenance.
Recommendation — Scan and track Apple endpoints until the vulnerable build is removed. Apply the vendor fix or mitigation as soon as operationally possible.

Practitioner Guidance

What to prioritise: Treat any device that cannot be rapidly updated as a higher-risk exception, and prioritise assets that hold sensitive mail, MDM enrollment, developer credentials, or administrative access. If you have multiple Apple device cohorts, verify each one separately rather than assuming a single remediation action covers them all.

What to verify: Confirm that the vulnerable build is actually gone from managed inventory, not just queued for update. Where patching lags, verify whether the device has recent signs of suspicious behaviour, unusual profile changes, or security tooling degradation that would justify a compromise review.

Practitioner takeaway: For a KEV-listed kernel flaw, the key decision is whether any exposed device remains reachable long enough to be exploited, so prioritise removal of exposure before debating how likely abuse is on any single endpoint.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org