Yes. CISA added CVE-2023-41993 to its Known Exploited Vulnerabilities catalogue on 25 September 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content.
How to treat CVE-2023-41993 as an active exploitation issue
This is not a “wait and see” vulnerability question. Once a CVE is in CISA’s Known Exploited Vulnerabilities catalogue, the practical assumption should be that attackers have something useful to gain from it, and that exposure may already exist across browsers and Apple platforms using WebKit. The first task is to confirm where Safari and WebKit are present, because browser-based exploitation often reaches far beyond a single application.
For triage, focus on internet-facing or user-driven attack paths first. Web content processing means a malicious page, ad, embedded object, or redirected link can become the delivery mechanism, so endpoint coverage alone is not enough if users can browse unmanaged or partially managed devices. Enterprise Browser and Browser Security Guide is useful here because browser policy, extension control, isolation, and telemetry are part of the exposure story, not just browser versioning.
When the browser is part of a broader exploitation chain, look for the surrounding conditions too: unsigned or unvetted content, unrestricted browsing on high-value systems, and any environment where a successful code execution bug could lead to credential theft, session theft, or lateral movement. Browser code execution is often only the first step, not the final objective.
What remediation and exposure checks matter most
The immediate response is to apply the vendor fix or mitigation referenced by Apple and CISA, then verify that the affected software actually moved onto the intended build or configuration. For KEV-listed issues, remediation is about closing the exploit path quickly, not waiting for a convenient maintenance window. CISA Known Exploited Vulnerabilities Catalog is the authoritative source for the exploitation status, while the vendor advisory is where version and platform details belong.
Use this as an opportunity to check for secondary exposure. If a WebKit exploit ran on a user device, the next question is what the browser could access, not just whether the browser crashed. That means assessing saved sessions, tokens, password stores, corporate web apps, and any secrets reachable from the user profile or browser context. CVE Program records help anchor the vulnerability identity, but they do not replace incident validation on the endpoint.
If patching must wait, the safest compensating controls are those that reduce reachable attack surface and contain execution. That usually means restricting exposure to untrusted web content, tightening browser isolation, and prioritising high-risk users such as administrators, developers, and help desk staff who hold broader browser-visible access. NIST National Vulnerability Database is useful as a secondary reference for record linkage and downstream prioritisation, but remediation should be driven by active exploitation status first.
What exploitation in the wild means for incident readiness
A KEV listing changes the operational assumption. You should treat the issue as something worth hunting for, even if you have not yet observed a confirmed compromise internally. That shifts the focus from simple patch deployment to compromise assessment, especially on systems that browsed hostile content during the exposure window. If evidence exists of suspicious browser activity, unexplained child processes, or unusual post-browse behaviour, investigate before and after remediation.
Browser exploits often leave limited obvious artefacts, so the best evidence is frequently indirect: unexpected web history, unusual downloads, browser process crashes tied to suspicious sites, or telemetry that shows the device reaching untrusted infrastructure immediately before anomalous activity. In practice, teams should assume that a code execution flaw in the browser stack can be an entry point into a broader access event, especially when the endpoint is also used for email, SSO, or cloud console access.
Risk and Threat Considerations
Active exploitation raises the risk that a normally routine browser interaction becomes an initial access path. The main concern is not only code execution itself, but the downstream opportunity to steal session material, stage additional payloads, or pivot into higher-value accounts and services from a trusted user device.
Failure mechanism: Malicious web content reaches the vulnerable WebKit processing path and executes attacker-controlled code in the browser context, which can then be used to support follow-on access, data theft, or further exploitation.
Impact: A successful exploit can expose browser-held material and create a foothold on an Apple device that users trust for work access, increasing the chance of account compromise or broader organisational intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid exposure identification and remediation central. |
| Recommendation — Prioritise KEV-listed browser flaws for immediate remediation and verify exposure continuously. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The subject is an exploited software flaw requiring timely fix validation and remediation tracking. |
| IR-4 — Incident Handling | KEV-listed exploitation requires compromise assessment and response coordination, not patching alone. | |
| Recommendation — Track, remediate, and verify the fix for the vulnerable browser component quickly. Escalate to incident handling when evidence suggests exploitation or post-exploit activity. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded | Determining where WebKit is deployed is the first step in managing the exploited exposure. |
| Recommendation — Identify exposed Apple and browser assets before deciding containment priority. | ||
| MITRE ATT&CK | T1189 — Drive-by Compromise | Web content delivering browser exploitation fits the drive-by compromise pattern. |
| Recommendation — Hunt for browser-driven initial access and review the web-delivery path. | ||
Practitioner Guidance
What to prioritise: Triage affected Apple device populations by real exposure, not just by software inventory. Systems used for email, SSO, admin access, or sensitive web applications should move to the front of the queue because browser compromise there has a larger blast radius.
What to verify: Confirm that patching or mitigation actually removed the vulnerable WebKit exposure, then validate whether the device shows signs of post-exploit behaviour. If you find suspicious browser artefacts, treat it as a compromise assessment problem, not a simple patch verification task.
Decision rule: If the device handled untrusted web content during the exposure window and also had access to corporate sessions or secrets, prioritise incident review and credential/session review alongside remediation. The practical question is whether the browser may have exposed usable access, not whether the exploit was publicly discussed.
Practitioner takeaway: For KEV-listed browser flaws, fast remediation is necessary, but the higher-value judgement is whether the browser context may already have been turned into access, which is what should drive hunting and containment.
Related resources from NHI Mgmt Group
- CVE-2023-41993 (Apple Multiple Products WebKit Code Execution)
- Is CVE-2024-44308 (Apple Multiple Products Code Execution) being exploited in the wild?
- Is CVE-2023-42916 (Apple Multiple Products WebKit Out-of-Bounds Read) being exploited in the wild?
- CVE-2023-37450 (Apple Multiple Products WebKit Code Execution)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org