ZeroDay Findings
Sign inSign up

Findings

CVE-2023-41991

Apple Multiple Products Improper Certificate Validation Vulnerability

Published Sep 21, 2023 · updated Jun 16, 2026 · apple ipados

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 21, 2023 · Catalog

    Detected

    A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

  2. Sep 25, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 16, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 16, 2023

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/ipados17.0
  • cpe apple/iphone osversion unspecified
  • cpe apple/iphone os17.0
  • cpe apple/macosversion unspecified
  • vendor Apple Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2023-41991

    Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

    cisa.gov
  • CVE.orgCVE-2023-41991

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-41991

    30-day exploitation probability 13.4%

    first.org
  • NIST NVDCVE-2023-41991

    A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS befor

    nvd.nist.gov

References