CVE-2023-41991: Apple iOS, iPadOS and macOS certificate validation bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with reported active exploitation, but it requires local access and user interaction and has only medium CVSS severity.

What it is

Apple iOS, iPadOS and macOS contain an improper certificate validation flaw (CWE-295) that lets a malicious app bypass signature validation. Apple states it is aware of a report that the issue may have been actively exploited against iOS versions before 16.7. It is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7.

Impact

An attacker who gets a malicious app onto the device can bypass signature validation, undermining the trust check that normally blocks tampered or unsigned code. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

The vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), so the attacker needs a malicious app installed and the user to trigger it. No remote or network path is described.

Exploitation

CVE-2023-41991 is listed in CISA KEV (added 2023-09-25), and Apple states the issue may have been actively exploited against iOS before 16.7. EPSS 30-day probability is 0.04547 (91st percentile). No ransomware campaign use is documented.

What to do

• Update to macOS Ventura 13.6, iOS 16.7 or iPadOS 16.7, or later, per Apple advisories HT213927 and HT213931.
• If immediate patching is not possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product.
• Restrict app installation to trusted sources and enforce mobile device management controls that block sideloaded or untrusted apps.
• Monitor Apple security advisories for follow-up fixes on other OS branches not covered by these versions.

Detection

• Audit managed Apple devices for OS versions below iOS/iPadOS 16.7 or macOS Ventura 13.6 and flag them for remediation.
• Review app installation telemetry for sideloaded, enterprise-signed or otherwise untrusted apps on affected devices.
• Hunt for code-signing or certificate validation failures in device logs that coincide with app launches on unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.