CVE-2023-41991

Apple's September 2023 security updates fix a certificate validation flaw (CWE-295) in iOS, iPadOS, and macOS that allowed a malicious app to bypass signature validation. The bug is exploited locally: a victim must run or install a crafted app (local attack vector with user interaction per the CVSS scoring), and the flawed validation lets that app masquerade as legitimately signed code. A successful attacker gains high integrity impact, defeating Apple's signature checks so malicious code can run or persist as if it were properly signed. Users of iOS and iPadOS versions before 16.7 and macOS Ventura versions before 13.6 are affected. The flaw was exploited in the wild before the patch (Apple confirmed active exploitation of iOS prior to 16.7), it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-25, and related reporting around this disclosure ties the Apple zero-days to Predator commercial spyware campaigns.

What to do: Update iPhones and iPads to iOS 16.7 / iPadOS 16.7 (or later) and Macs to macOS Ventura 13.6 (or later) immediately, prioritizing high-risk users such as journalists, activists, and officials given the spyware-linked in-the-wild exploitation. Because the bug is in CISA's KEV catalog, patch promptly to meet federal remediation timelines, verify device versions in Settings/About, and hunt for indicators of spyware compromise on devices that remained on pre-16.7 iOS.