{"id":"CVE-2020-9859","kind":"vulnerability","aliases":["CVE-2020-9859"],"related":[],"title":"Apple Multiple Products: Apple Multiple Products Code Execution Vulnerability","description":"A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.","summary":"Apple iOS, iPadOS, macOS, watchOS and tvOS contain an unspecified flaw that lets an application execute code with kernel privileges. An attacker who can run an app on the device can take full control of the operating system.","severity":"high","cvss":7.8,"epss":0.00829,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","infrastructure","ios","ipados","macos","tvos","watchos"],"not_affected_if":["fully-patched-devices"],"how_to_check":"Check the installed OS version on each Apple device (macOS: About This Mac; iOS/iPadOS: Settings > General > About) and compare it with the patched release listed in Apple's security notes.","fix":"Update iOS, iPadOS, macOS, watchOS and tvOS to a release that includes Apple's fix for CVE-2020-9859, as CISA directs.","status":"open","published_at":"2020-06-05T15:15:11+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:54+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:33:54Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS, watchOS and tvOS to a release that includes Apple's fix for CVE-2020-9859, as CISA directs.\nunknown","reach":"local","impact":"high","summary":"Apple iOS, iPadOS, macOS, watchOS and tvOS contain an unspecified flaw that lets an application execute code with kernel privileges. An attacker who can run an app on the device can take full control of the operating system.","category":"infrastructure","who_cares":["apple","ios","macos","ipados","watchos","tvos"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Malicious app gains kernel privileges and full device control.","analyst_note":"Find Apple's security notes for CVE-2020-9859 to confirm the patched versions and whether exploitation requires a malicious app on the device.","how_to_check":"Check the installed OS version on each Apple device (macOS: About This Mac; iOS/iPadOS: Settings > General > About) and compare it with the patched release listed in Apple's security notes.\nunknown","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000502,"input_tokens":2835,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':11A,14A '-9859':12A,15A '10.15.5':87C '13.4.6':91C '13.5.1':81C,84C '6.2.6':93C 'abl':98C 'address':70C 'app':53B 'appl':1A,4A,19B,27B 'apple':16A 'applic':41B,95C 'arbitrari':101C 'attack':48B 'catalina':86C 'code':7A,43B,102C 'consumpt':67C 'contain':34B 'control':60B 'cve':10A,13A 'devic':56B 'execut':8A,42B,100C 'exploit':20B 'fix':78C 'flaw':37B 'full':59B 'handl':74C 'improv':72C 'infrastructur':21B 'io':22B,28B,80C 'ipado':23B,29B,83C 'issu':68C,76C 'kernel':45B,104C 'let':39B 'maco':24B,30B,85C 'may':96C 'memori':66C,73C 'multipl':2A,5A 'multiple':17A 'oper':63B 'privileg':46B,105C 'product':3A,6A 'products':18A 'run':51B 'supplement':88C 'system':64B 'take':58B 'tvos':25B,33B,90C 'unspecifi':36B 'updat':89C 'vulner':9A 'watcho':26B,31B,92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-06-05T15:15:11+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-9859","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9859","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2020-9859","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-9859","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-9859","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9859","severity":null,"published_at":"2020-06-05T15:15:11+00:00","modified_at":"2026-06-17T03:28:41+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}