CVE-2023-41991

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.134 · 96 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

13.4% (96th) EPSS

CVSS 5.5 · medium

Is it mine?

22 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2023-09-25remediate by 2023-10-16

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-22

Apple Multiple Products Improper Certificate Validation Vulnerability

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondaryexploitability 1.8 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USprimaryCWE-295US

exploits (3)

Public proof-of-concept and weaponised exploit code.

dmytrozykov/appsigniOS/macOS library that exploits CVE-2023-41991 for signing iOS applications.PoC · poc_in_github
itsgiddd/CVE-2023-41991itsgiddd/CVE-2023-41991PoC · poc_in_github
lambertse/MOchaCVE-2023-41991 vulnerability exploitationPoC · poc_in_github

affected products (22)

Products and version ranges known to be affected.

Apple iOS <16.7all versionscert_bundDE
Apple iOS <17all versionscert_bundDE
Apple iPadOS <16.7all versionscert_bundDE
Apple iPadOS <17all versionscert_bundDE
Apple IOS< 16.7cert_bundDE
Apple IOS< 17cert_bundDE
Apple iPadOS< 16.7cert_bundDE
Apple iPadOS< 17cert_bundDE
Apple iOS and iPadOSunspecified → 16.7enisa_euvdEU
Apple macOSunspecified → 13.6enisa_euvdEU
Apple Inc. MacOS≤ 13.6fstec_bduRU
Apple Inc. iOS≤ 17.0fstec_bduRU
Apple Inc. iOS≤ 16.7fstec_bduRU
Apple Inc. iPadOS≤ 16.7fstec_bduRU
Apple Inc. iPadOS≤ 17.0fstec_bduRU
Apple Inc. watchOS≤ 10.0fstec_bduRU
Apple Inc. watchOS≤ 9.6.3fstec_bduRU
apple ipados< 16.7nvdUScpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple ipados= 17.0nvdUScpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple iphone os< 16.7nvdUScpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2427Apple iOS: Mehrere SchwachstellenDeutsch2023-09-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um Sicherheitsmaßnahmen zu umgehen, seine Privilegien zu erweitern oder beliebigen Code auszuführen.
WID-SEC-W-2023-2453Apple macOS: Mehrere SchwachstellenDeutsch2023-09-26csaf · cert_bundDE
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, seine Rechte zu erweitern oder Daten zu manipulieren.
WID-SEC-W-2023-2454Apple iOS und iPadOS: Mehrere SchwachstellenDeutsch2023-09-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen preiszugeben, Dateien zu manipulieren oder seine Privilegien zu erweitern.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2023-09-21modified 2026-06-17

related (1,877)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-85102US	—OT critical	54.2% (99th)	KEV	2026-09-09
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the G…
CVE-2023-20963US	high7.8OT critical	1.47% (73rd)	KEV	2023-03-24
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…
CVE-2022-26923US	high9.0OT critical	83.5% (100th)	KEV	2022-05-10
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2022-20703US	high8.0OT critical	9.20% (95th)	KEV	2022-02-10
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr…
CVE-2020-0601US	high8.1OT critical	89.4% (100th)	KEV	2020-01-14
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by u…

+1872 more

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan