Yes. CISA added CVE-2023-41974 to its Known Exploited Vulnerabilities catalogue on 5 March 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS and iPadOS contain a use-after-free vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.
What “exploited in the wild” means for this CVE
For CVE-2023-41974, the practical question is not whether the bug exists, but whether it has crossed from theory into active abuse. CISA’s KEV listing is the strongest public signal that defenders should treat the issue as actively exploited, and for a use-after-free in a mobile operating system, that changes the response from routine patching to urgent exposure control and compromise review.
CISA Known Exploited Vulnerabilities Catalog is the authority to verify whether a CVE is being treated as actively exploited and whether remediation timelines apply.
NIST National Vulnerability Database remains the most useful place to confirm the CVE record, affected product context, and the broader technical description once you have the exploitation status.
Why iOS and iPadOS use-after-free flaws are operationally serious
A use-after-free in a mobile operating system is dangerous because memory corruption can be turned into code execution or other forms of control-flow abuse if an attacker can reliably trigger the condition. On managed mobile fleets, that matters because the same device often carries mail, messaging, app tokens, VPN access, and enterprise sessions, so a single exploited endpoint can become a foothold into business data and services.
Use the Mobile Device Security Guide to frame remediation around device posture, enrolment status, and control of unmanaged or out-of-policy devices rather than around the CVE alone.
The vulnerability class is also a reminder that mobile exploitation often leaves few obvious signs at the endpoint level. That makes exposure assessment, patch priority, and log review more important than waiting for a visible alert or a confirmed user complaint.
What to do first if you may be exposed
The first task is to identify every iPhone and iPad in scope, then check which devices are on versions that Apple has not yet remediated for this issue. That inventory step should include corporate-owned, BYOD, shared, and kiosk devices, because exploitation risk depends on actual exposure, not ownership label.
Vulnerability Management Guide is the best internal reference for turning KEV status into an asset-scoped remediation decision, exception handling, and verification.
Zero-Day and Exploited Vulnerabilities Guide is useful here because the same emergency triage logic applies when a vulnerability has a confirmed exploitation signal and patch timing becomes a security decision, not a scheduling choice.
Apple’s advisory and CISA’s KEV entry should be the authoritative sources for version-specific remediation details. Use them to validate whether the device is still exposed, then patch or mitigate immediately rather than waiting for the next normal maintenance cycle.
Risk and Threat Considerations
Actively exploited mobile flaws matter because they can be used for targeted compromise before defenders have broad telemetry or signature coverage. In practice, the main risk is silent access to the device’s stored sessions and enterprise data, followed by secondary abuse of trusted apps, mail, or remote access services.
Failure mechanism: An attacker exploits the memory corruption condition on a reachable device, gains code execution or a stable foothold, and then uses the compromised phone or tablet as an authenticated entry point into enterprise systems.
Impact: The result can be data theft, session abuse, account takeover, or further lateral movement through trusted mobile access paths, especially if the device held tokens or was allowed to connect to sensitive services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited mobile CVEs require rapid exposure identification and remediation prioritisation. |
| Recommendation — Prioritise remediation of KEV-listed devices and verify closure through rescan or inventory reconciliation. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires asset scoping, exposure verification, and timely vulnerability tracking. |
| IR-4 — Incident Handling | Confirmed active exploitation calls for compromise checks and response actions beyond patching. | |
| Recommendation — Scan managed mobile assets for exposure and track remediation until the vulnerable versions are removed. Trigger incident handling steps to review logs, isolate suspect devices, and assess possible compromise. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Prioritized | KEV status changes prioritisation for this actively exploited mobile weakness. |
| Recommendation — Rank exposed iOS and iPadOS assets ahead of routine backlog items and remediate first. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | If the device held sessions or tokens, exploitation can expose durable access material. |
| Recommendation — Rotate exposed tokens and revoke sessions on compromised mobile endpoints. | ||
Practitioner Guidance
What to prioritise: Patch every exposed device first, then focus on devices that have enterprise mail, VPN, mobile management, or privileged access apps installed. A device with those apps raises the blast radius even if no compromise is yet confirmed.
What to verify: Confirm whether the device was online and in use during the exposure window, whether it has any security logging or MDM telemetry available, and whether users reported crashes, unusual prompts, or session interruptions that could indicate compromise.
Decision rule: If patching must wait, isolate the device from sensitive resources, remove unnecessary enterprise access, and treat the device as higher risk until it is remediated and checked. If the device handled privileged or sensitive sessions, rotate any exposed credentials or revoke sessions where your environment allows it.
Practitioner takeaway: KEV status should drive urgency, but the real security decision is whether the device had the access needed to turn exploitation into downstream compromise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org