Apple products vulnerable to arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Apple released patches for multiple critical vulnerabilities affecting iOS, macOS, Safari, and other products; no active exploitation reported.
A CIS-ISAC advisory documents multiple vulnerabilities across Apple's product line, with the most severe enabling arbitrary code execution in the context of the logged-on user. The affected products span iOS 18.7.2 and earlier, iPadOS 18.7.2 and earlier, macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe, Safari 26.1, Xcode 26.1, watchOS 26.1, tvOS 26.1, and visionOS 26.1. Vulnerabilities range from privilege escalation via sudo misconfiguration (CVE-2025-32462) to memory corruption from malicious web content and media files, sandbox escapes, and data exfiltration. The advisory notes no active exploitation in the wild at time of publication.
The vulnerability set encompasses multiple attack vectors: processing malicious web content or media files can corrupt memory, certain configurations allow privilege escalation to root, and several issues permit sandbox breakout and access to sensitive user data. Additional vulnerabilities enable address-bar spoofing, privacy-preference bypass, keystroke monitoring without permission, and physical-access attacks against locked devices. The impact depends on user privilege level; administrative users face greater risk. Apple has issued patches across all affected versions and CIS-ISAC recommends immediate patching after testing, alongside implementation of least-privilege principles, application allowlisting, and endpoint detection and prevention controls.
Mentioned in this report
Detection guidance
Sudo Invoked with Remote Host Option (CVE-2025-32462 Abuse)
Detects sudo run with the -h/--host option followed by a host argument on Linux. This is the pattern used to abuse the sudoers host-matching flaw CVE-2025-32462 for privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sudo Invoked with Remote Host Option (CVE-2025-32462 Abuse)
description: Detects sudo executed with the -h or --host option and a host argument
on Linux. Abuse of this option can bypass host-restricted sudoers rules (CVE-2025-32462).
Plain 'sudo -h' (help) has no argument and is not matched.
tags:
- attack.privilege-escalation
- attack.t1548.003
- cve.2025-32462
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /sudo
CommandLine|contains:
- ' -h '
- ' --host='
- ' --host '
filter_help:
CommandLine|contains: ' --help'
condition: selection and not filter_help
falsepositives:
- Administrators deliberately testing host-scoped sudoers rules with sudo -l -h
- Configuration management tooling that audits sudoers for other hosts
level: medium
id: bd478ec5-4444-5e92-8ba1-fd442bbb8fd6
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102
Sudo Invoked with Remote Host Option on macOS (CVE-2025-32462 Abuse)
Detects sudo run with the -h/--host option followed by a host argument on macOS. This is the pattern used to abuse the sudoers host-matching flaw CVE-2025-32462. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sudo Invoked with Remote Host Option on macOS (CVE-2025-32462 Abuse)
description: Detects sudo executed with the -h or --host option and a host argument
on macOS. Abuse of this option can bypass host-restricted sudoers rules (CVE-2025-32462).
Plain 'sudo -h' (help) has no argument and is not matched.
tags:
- attack.privilege-escalation
- attack.t1548.003
- cve.2025-32462
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /sudo
CommandLine|contains:
- ' -h '
- ' --host='
- ' --host '
filter_help:
CommandLine|contains: ' --help'
condition: selection and not filter_help
falsepositives:
- Administrators deliberately testing host-scoped sudoers rules with sudo -l -h
- Enterprise management scripts that query sudo privileges for other hosts
level: medium
id: 50910abd-40b1-5a92-9b47-82cfd0310549
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-102
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs