CVE-2017-2478

This flaw is in the “Kernel” part of Apple’s operating system, which is the core that everything depends on. A malicious app could try to exploit a timing/race issue to gain more control than it should—like slipping past the “locked door” protections and running with extra privileges. If your devices are on older versions, that door may still be open.

This matters if your business uses Apple devices running older operating systems in the ranges listed by the advisory (iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, watchOS before 3.2). Because the weakness involves a crafted app, the main risk is exposure through installing and running a malicious application on an affected device. It’s a risk only if an attacker can get a crafted app onto a device that’s reachable and actually running those vulnerable OS versions.

Mark this as AMBER: there is a public exploit available, and interest/coverage is rising, which increases the chance of real-world attempts. However, it is not listed in CISA KEV, so there isn’t confirmed “widespread, ongoing” exploitation guidance from that source. Still, if any device remains on the affected older versions, you should patch promptly.