The issue was addressed with improved input sanitization

CVE-2026-43724 is one of the kernel-side input-validation bugs Apple closed in the iOS 26.5.2 / iPadOS 26.5.2 cycle on June 29, 2026. Per Apple's release notes, the affected kernel path could be coerced by a malicious application into unexpected termination, kernel-memory write, kernel-state disclosure, or memory corruption — i.e., a sandbox-escape / EOP primitive, not a network listener bug. Affected versions are all iOS/iPadOS builds prior to 26.5.2; the fix is improved input sanitization on the affected syscall/IOKit interface.

The vendor severity (CRITICAL 9.8 with AV:N/AC:L/PR:N/UI:N) does not match the technical reality. A kernel bug reachable only from an *installed application* is AV:L/PR:L, not AV:N/PR:N. Apple's CNA frequently publishes inflated vectors on kernel CVEs in batch advisories; the realistic CVSS sits in the 7.0–7.8 band. The capability is still serious — kernel write means full device compromise, MDM bypass, and Lockdown Mode is *not* a guaranteed mitigation — but the threat model is malicious-app-installed, not drive-by-network.

Why this verdict

• Attack vector is local, not network. Apple's own description ("an application may be able to…") is AV:L/PR:L, which alone drops the score by ~2 points from the published 9.8.
• No active exploitation and no KEV listing. Apple flags exploited kernel bugs explicitly in the same bulletin; CVE-2026-43724 was not flagged.
• EPSS 0.0018 + no public PoC means the realistic 30-day exploitation likelihood is near zero outside of mercenary-spyware shops who would burn this on high-value targets, not enterprise mass.
• Role multiplier — executive / high-risk mobile users: chain succeeds, ends in device takeover and Keychain/MDM-token theft. Blast radius is per-device, not per-fleet — high-value-user exposure keeps the floor at HIGH but does not justify CRITICAL.
• Role multiplier — corporate fleet workstation-class iPhone: chain succeeds but requires a malicious app reaching the device, which MDM allow-listing materially blocks. Blast radius stays at the single device.

Why not higher?

Not CRITICAL because (a) the attack requires an installed malicious application — not a network packet, not a malicious URL, not an email — which gates the realistic threat actor pool to those who can ship apps to a target (mercenary spyware, supply-chain compromise of a legitimate app, or social-engineering a sideload); and (b) there is no exploitation evidence, no KEV, no public PoC. The vendor's 9.8 reflects worst-case capability, not realistic exposure.

Why not lower?

Not MEDIUM because the primitive — kernel-memory write / kernel-state disclosure — is the exact capability that mercenary-spyware vendors weaponize, and the affected fleet (every non-26.5.2 iPhone/iPad in the enterprise) is large. On VIP and high-risk-user devices the blast radius is unacceptable to defer beyond the standard 30-day HIGH window.

1. Push iOS/iPadOS 26.5.2 via MDM compliance policy now — Set Intune/Jamf/Workspace ONE minimum-OS to 26.5.2, block corporate resource access (Conditional Access / Jamf Connect) for devices below that build. Per the noisgate mitigation SLA for HIGH, complete within 30 days; for VIP/executive devices, treat as 3 days.
2. Enable Lockdown Mode on VIP, journalist, executive, and high-risk-traveler devices — Lockdown Mode shrinks the kernel-reachable attack surface (restricts configuration profiles, MDM enrollment changes, message attachment processing) and is the single most effective control against the mercenary-spyware threat actor most likely to weaponize this CVE.
3. Tighten app allow-listing and disable sideloading / enterprise-cert profiles — In Intune/Jamf, restrict installation to the corporate VPP catalog; revoke unused enterprise developer profiles. The attack requires app delivery — choke the delivery channel.
4. Deploy mobile EDR (Jamf Protect, Lookout, Zimperium, Wandera) to the fleet — These tools collect kernel panic logs and detect known commercial-spyware indicators; they will not block this bug but will catch post-exploit behavior and surface jailbreak-state anomalies.
5. Run iVerify / MVT scans on VIP devices monthly — MVT (Mobile Verification Toolkit) and iVerify hunt for Pegasus/Predator-class IOCs and detect anomalous kernel/process state consistent with kernel-corruption exploitation.

Run on your MDM admin workstation (macOS or Linux) against an exported device inventory CSV. Requires read access to the Intune/Jamf device list and jq. Example invocation: ./check-43724.sh devices.csv where devices.csv has columns device_id,os_version.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-43724 (iOS/iPadOS kernel input-validation)
# Fixed in iOS/iPadOS 26.5.2. Anything below is VULNERABLE.
set -euo pipefail

FIXED_MAJOR=26
FIXED_MINOR=5
FIXED_PATCH=2

if [ $# -ne 1 ]; then
  echo "usage: $0 <mdm-export.csv>  (columns: device_id,os_version)" >&2
  exit 2
fi
CSV="$1"
[ -r "$CSV" ] || { echo "cannot read $CSV" >&2; exit 2; }

vuln=0; patched=0; unknown=0

while IFS=, read -r dev ver; do
  [ "$dev" = "device_id" ] && continue
  ver_clean="${ver//\"/}"
  if [[ ! "$ver_clean" =~ ^([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]]; then
    echo "$dev UNKNOWN ($ver_clean)"
    unknown=$((unknown+1)); continue
  fi
  M=${BASH_REMATCH[1]}; m=${BASH_REMATCH[2]}; p=${BASH_REMATCH[4]:-0}
  if (( M < FIXED_MAJOR )) || \
     (( M == FIXED_MAJOR && m < FIXED_MINOR )) || \
     (( M == FIXED_MAJOR && m == FIXED_MINOR && p < FIXED_PATCH )); then
    echo "$dev VULNERABLE ($ver_clean)"
    vuln=$((vuln+1))
  else
    echo "$dev PATCHED ($ver_clean)"
    patched=$((patched+1))
  fi
done < "$CSV"

echo "---"
echo "VULNERABLE=$vuln PATCHED=$patched UNKNOWN=$unknown"
if (( vuln > 0 )); then exit 1; fi
if (( unknown > 0 )); then exit 3; fi
exit 0

Sources

1. Apple security releases index
2. Cyber Express — Apple iOS 26.5.2 fixes 30+ flaws
3. CISA KEV catalog
4. CISA weekly vulnerability summary
5. FIRST EPSS model
6. NVD — CVE-2026-43724
7. Mobile Verification Toolkit (MVT)
8. Apple Lockdown Mode docs