# Apple patches critical privilege escalation across iOS, macOS, Safari

Published: 2026-06-09 · Severity: high
Canonical: https://vorant.io/reports/d450e5d6-df9a-5a42-8155-eade8be3cb2c/apple-patches-critical-privilege-escalation-across-ios-macos-safari

> Apple releases patches for multiple critical vulnerabilities, including active exploitation of a privilege escalation flaw in iOS before version 17.2.

Apple has released security updates addressing multiple vulnerabilities across its product ecosystem, the most severe of which enable arbitrary code execution and privilege escalation. The most critical issue is CVE-2025-24085, a privilege escalation flaw in iOS that Apple confirms has been actively exploited in the wild against versions before iOS 17.2. This vulnerability allows a malicious application to elevate privileges, potentially leading to full system compromise depending on the user's account privileges.

The vulnerability set spans multiple Apple platforms including iOS, iPadOS, macOS (Ventura, Sonoma, Sequoia), visionOS, watchOS, tvOS, and Safari. Key high-severity vulnerabilities include CVE-2025-24159 (kernel privilege execution via app), CVE-2025-24153 (kernel privilege execution from root app), CVE-2025-24156 (app privilege escalation), and CVE-2025-24137 (remote code execution). Additional medium and low-severity issues address denial-of-service conditions, information disclosure, sandbox escapes, privacy bypass, and data access vulnerabilities.

Defenders should immediately apply the stable channel updates provided by Apple to all affected systems, particularly iOS, iPad, and macOS deployments. Given active exploitation in the wild, priority should be given to iOS updates to version 17.2 or later. Organizations should enforce least-privilege access controls, enable System Integrity Protection and Gatekeeper on macOS systems, and maintain robust vulnerability management and endpoint detection processes.

## Mentioned in this report

- Vulnerabilities: CVE-2024-54478, CVE-2024-54497, CVE-2024-54509, CVE-2024-9956, CVE-2025-24085 (KEV), CVE-2025-24086, CVE-2025-24087, CVE-2025-24102, CVE-2025-24103, CVE-2025-24104, CVE-2025-24106, CVE-2025-24107, CVE-2025-24112, CVE-2025-24113, CVE-2025-24117, CVE-2025-24118, CVE-2025-24123, CVE-2025-24124, CVE-2025-24126, CVE-2025-24127, CVE-2025-24128, CVE-2025-24129, CVE-2025-24131, CVE-2025-24137, CVE-2025-24141, CVE-2025-24143, CVE-2025-24145, CVE-2025-24149, CVE-2025-24150, CVE-2025-24153, CVE-2025-24154, CVE-2025-24156, CVE-2025-24158, CVE-2025-24159, CVE-2025-24160, CVE-2025-24161, CVE-2025-24162, CVE-2025-24163, CVE-2025-24166, CVE-2025-24177

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2025-011

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d450e5d6-df9a-5a42-8155-eade8be3cb2c/apple-patches-critical-privilege-escalation-across-ios-macos-safari.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup