Apple Multiple Products Improper Certificate Validation Vulnerability

MEDIUM 5.5EXPLOITED (CISA KEV)CVE-2023-41991 · Published 21/09/2023 · updated 17/06/2026

Apple Multiple Products Improper Certificate Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/09/2023. Patch affected systems as an emergency.

In short

CVE-2023-41991 is a MEDIUM (CVSS 5.5) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 25/09/2023.
Chance of exploitation in the next 30 days (EPSS): 13.4%, higher than 96.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
Multiple Products Apple	Versions not published yet (product named by CISA KEV)

Description

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

References

support.apple.com/en-us/HT213927 · Vendor Advisory
support.apple.com/en-us/HT213931 · Vendor Advisory
support.apple.com/kb/HT213927 · Vendor Advisory
support.apple.com/kb/HT213931 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-41991

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free