Is CVE-2025-24200 (Apple iOS and iPadOS Incorrect Authorization) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-24200 to its Known Exploited Vulnerabilities catalogue on 12 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

What active exploitation means for this Apple mobile vulnerability

CVE-2025-24200 is not just a theoretical iOS or iPadOS bug. The practical question is whether a locked device can still be manipulated by someone with physical access, and whether the issue can be used before normal safeguards are restored. For response purposes, treat it as an exposed-device problem, not a patch-note curiosity.

Because CISA placed it in the KEV catalogue, the operational assumption should be that exploitation is credible and current until proven otherwise. That changes triage order, especially for shared, customer-facing, executive, travel, and law-enforcement style use cases where physical custody may be weaker.

Where the weakness sits in the device trust model

The flaw is an mobile device security problem because it weakens a setting meant to preserve trust when a device is locked. USB Restricted Mode is designed to narrow what a locked phone or tablet will accept over a physical connection, so bypassing it changes the device’s exposure boundary rather than merely breaking a convenience feature.

That makes physical access the decisive condition. If an attacker can reach an unattended or briefly unattended device, the question is not only whether data can be read immediately, but whether the device can be put into a state that broadens later abuse, inspection, or follow-on exploitation.

For practitioners, the issue also sits alongside broader vulnerability handling rather than simple mobile hardening. A guide to zero-day and actively exploited vulnerabilities is relevant here because KEV-listed issues need faster confirmation, prioritisation, and post-remediation checks than ordinary advisories.

What to do when patching or updating is not immediate

If devices cannot be updated right away, the immediate control is exposure reduction: keep the device under the owner’s physical control, tighten supervision during travel or field use, and treat locked-device USB access as a sensitive trust boundary. This is especially important for devices that may hold enterprise mail, tokens, or other managed access material.

Verification should focus on whether the device was in a condition where an attacker could have had sustained physical access before the update was applied. If that is possible, the response should include compromise review, not just software remediation. For mobile fleets, the relevant destination knowledge is the vulnerability management guide, because KEV items need asset scoping, remediation status, exception handling, and verification evidence.

Where the device may have been exposed, review for signs of tampering, unusual pairing, unexpected configuration change, or access that would not normally be possible on a locked device. If the device supported enterprise email, VPN, or SSO access, consider whether session material should be refreshed even if the handset itself shows no obvious damage.

Risk and Threat Considerations

Physical exploitation is the core risk here. An incorrect-authorization flaw that changes locked-device behaviour can let an attacker defeat an assumption that defenders rely on during loss, theft, or brief access events, which is why active exploitation matters even when the flaw is narrow in scope.

Failure mechanism: A physical attacker uses the authorization weakness to disable USB Restricted Mode on a locked device, then leverages the expanded USB trust window for follow-on access, inspection, or further abuse.

Impact: The device’s protected state is weakened, increasing the chance of data exposure, tampering, or additional compromise before the owner notices or recovery controls take effect.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Mobile exposure response depends on knowing which devices and accounts are in scope.
Recommendation — Inventory and track exposed devices and related accounts before declaring remediation complete.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Managed	KEV-listed device flaws require vulnerability identification and prioritisation.
Recommendation — Prioritise the affected devices for remediation based on exposure and exploitation evidence.
NIST SP 800-53 Rev 5	IR-4 — Incident Handling	Potential physical exploitation calls for compromise assessment and response handling.
	SI-2 — Flaw Remediation	The vulnerability must be remediated quickly once confirmed in the fleet.
	AC-19 — Access Control for Mobile Devices	USB Restricted Mode and locked-device exposure are mobile access-control issues.
Recommendation — Investigate suspiciously exposed devices and preserve evidence before reusing them. Apply the vendor fix and verify affected devices are updated. Enforce mobile-device access controls that limit physical-port exposure when locked.

Practitioner Guidance

What to prioritise: Confirm which iPhones and iPads are exposed, then separate them by custody risk. Devices used in travel, field work, executive protection, or shared environments deserve faster handling than stationary corporate devices.

What to verify: Check whether any affected device was lost, briefly unattended, serviced by an unknown party, or handled in a way that could have enabled physical exploitation before remediation. If yes, treat the device as a candidate for compromise assessment, not only update verification.

Decision rule: If the device may have been physically accessible before patching, pair software remediation with credential and session review for the services that device could reach. If not, focus on rapid update completion and custody controls.

Practitioner takeaway: For KEV-listed mobile flaws with a physical attacker condition, the key judgement is whether the device was ever out of trustworthy custody, because that determines whether you need only remediation or remediation plus compromise response.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org