Apple has identified and fixed three zero-day vulnerabilities in its software, which are actively being exploited. These vulnerabilities are identified as CVE-2023-41993 (in WebKit), CVE-2023-41991 (in the Security framework), and CVE-2023-41992 (in the Kernel Framework). They allow attackers to bypass security checks, execute malicious code, and escalate privileges on compromised devices.

Threat Actors: While specific threat actors have not been disclosed, historical data from Citizen Lab and the Google Threat Analysis Group suggests that zero-days like these have been exploited in targeted spyware attacks. High-risk individuals, such as journalists, opposition politicians, and dissidents, have been the primary targets.

Historical Context: Earlier this year, Citizen Lab and Apple reported the discovery and exploitation of other zero-day vulnerabilities (CVE-2023-41061 and CVE-2023-41064) as part of a zero-click exploit chain. These vulnerabilities were used to deliver the NSO Group's Pegasus commercial spyware onto fully patched iPhones. (Link to our advisory)

Technology Targeted: The vulnerabilities target Apple devices, including iPhones, iPads, Apple Watches and Macs running macOS Monterey and newer. This makes them particularly attractive to threat actors due to the widespread adoption of Apple products.

Impact on CIA Triad: These vulnerabilities have the potential to compromise the Confidentiality, Integrity, and Availability (CIA) triad of information security. Attackers can gain unauthorized access to sensitive data (Confidentiality), tamper with device functionality and data (Integrity), and disrupt normal device operations (Availability).