CISA Flags Apple Patch Exploit as Active Threat, Adds Flaw to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced Wednesday that a medium‑severity vulnerability affecting several Apple operating systems has been moved to its Known Exploited Vulnerabilities (KEV) catalog after confirming active attacks. The flaw, which was patched by Apple earlier this year, is now being leveraged by cybercriminals to distribute information‑stealing malware to both consumer devices and corporate endpoints.

Security researchers say the vulnerability permits unauthorised code execution on iOS, iPadOS, macOS and watchOS devices that have not applied the recent update. Once exploited, the malicious code can silently harvest credentials, personal data and system details before transmitting them to command‑and‑control servers. The technique mirrors a broader trend where threat actors prioritize exploits that are already known to vendors, betting that some users remain unpatched.

Apple released a security bulletin and corresponding patches in March, urging users to install the updates immediately. Despite the vendor’s warnings, the CISA notice indicates that a segment of the installed base remains vulnerable, providing a foothold for attackers. The agency’s KEV list, launched in 2022, tracks flaws that have been observed in the wild, helping federal and private organizations prioritize remediation efforts.

The malware delivered through the Apple flaw is classified as “info‑stealer” by multiple security firms. Its payload typically includes credential‑dumping modules that target password managers, email clients and cloud‑based services. While the exact groups behind the campaigns have not been identified, analysts suspect financially motivated actors seeking to harvest login data for resale on underground markets.

Cybersecurity experts stress that updating devices is the most effective mitigation step. They also recommend enabling automatic updates, employing mobile device management (MDM) tools to enforce patch compliance, and monitoring network traffic for signs of suspicious beaconing. For organizations with legacy Apple hardware that cannot be upgraded, segmentation and strict access controls are advised to limit potential exposure.

The episode underscores the challenges of maintaining a secure software ecosystem where patches are issued promptly but adoption can lag. Similar patterns have been observed with other high‑profile vendors, prompting calls for broader awareness campaigns aimed at end‑users and IT teams alike. CISA says it will continue to monitor the situation and may issue additional advisories if new indicators of compromise emerge.