CVE-2021-1870

Apple's WebKit in iOS, iPadOS, and macOS had a remote code execution vulnerability that was actively exploited in the wild.

A logic flaw in WebKit allowed remote attackers to execute arbitrary code on affected Apple devices and systems relying on WebKit. This failure is critical for DIB organizations because it represents an unpatched, actively exploited vulnerability that could compromise endpoint security and violate CMMC/NIST 800-171 requirements for patch management and vulnerability mitigation. Organizations must ensure all WebKit-based applications and operating systems are patched immediately and monitor for similar exploits in the supply chain.

Shame score — The vulnerability was actively exploited in the wild (KEV) and linked to ransomware campaigns, indicating a severe failure in patch management and vulnerability mitigation that directly impacts endpoint security and compliance posture.