Apple has released a series of critical security updates to fix several security flaws, two of which are new zero-day security vulnerabilities possibly exploited in the wild.
In an advisory issued on March 5, Apple said that it is “aware of a report that this issue may have been exploited."
At this point, it’s not clear how the flaws are being exploited in the wild, particularly for ransomware attacks.
The updates concern managed security service providers (MSSPs) and managed service providers (MSPs) that manage iPhone and iPad endpoints in business settings.
Apple iOS Critical Vulnerabilities
The vulnerabilities are as follows:
Apple said both bugs were addressed “with improved validation” in iOS 17.4, iPadOS 17.4, iOS 16.7.6, and iPadOS 16.7.6.
The cybersecurity updates concern the following devices:
“An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections,” for the vulnerable devices, Apple said.
CISA Action
The Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, in which it asked federal agencies to install updates by March 27, 2024.
CISA is also advising users to apply mitigations as instructed by Apple or discontinue using the product if mitigations are unavailable.
