Enrich and triage Apple security releases in the Vulnerability Intel Agent

BLUF

The Vulnerability Intel Agent now ingests each Apple security release within minutes of publication. Each CVE is continuously enriched with exploitation status, proof-of-concept activity, CISA KEV, CVSS, EPSS, and patch availability.

You can filter the release by exploitation activity, the products you run, or your patch policy thresholds to focus on the CVEs that require action.

How does it work?

• Add the filter. In the Vulnerability Intel Agent, select the Apple security release you want, or “Latest Apple Security Release,” which always points at the most recent one, and set the date range. Every CVE from the release appears in the output table. Apple is one of several vendor advisories available.
• Columns. Each enrichment field is a column, alongside the CVE ID and a plain description of the vulnerability. Reorder, show, or hide them to match how you triage.
• Alerts. Deploy the Intel Agent and get notified when new CVEs match your filters.

Filter by exploitation

Add filters for exploited, proof of concept, weaponized (exploited as part of a malware chain), or listed on the CISA KEV.

The June 29, 2026 release includes two CVEs with PoCs published June 30 and July 1. You can prioritize patching them and check your logs for exploitation attempts.

Filter to your stack

Filter the release at the product level, down to the Apple products you actually run.

The June 29 release includes 37 CVEs affecting macOS. You can focus on the systems you have to patch and skip the iOS and iPadOS entries that do not apply.

Filter by your patch policy

Most patch-now policies come down to a threshold: CVSS above a certain score, EPSS above a certain probability, or both. Set those thresholds as filters.

The June 29 release includes three CVEs at CVSS 8 and above with EPSS above 80%. You can remediate them immediately under your SLA and leave the rest for the normal cycle.