CISA Warns of Apple macOS, iOS, tvOS, Safari, and watchOS Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert about a critical vulnerability in multiple Apple products.

Tracked as CVE-2022-48503, this unspecified issue in the JavaScriptCore engine could allow attackers to execute arbitrary code simply by processing malicious web content. The flaw affects macOS, iOS, tvOS, Safari, and watchOS, putting millions of users at risk of remote exploitation.

First disclosed in 2022, the vulnerability has resurfaced in active attacks, according to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Security researchers note that while Apple patched it in subsequent updates, unpatched or end-of-life (EoL) systems remain prime targets.

“This isn’t just a relic of the past threat actors are weaponizing old bugs against outdated devices,” said a CISA spokesperson in the advisory.

The agency emphasized that the vulnerability’s severity stems from its potential for full system compromise, enabling data theft, ransomware deployment, or further malware spread.

Although no direct ties to ransomware campaigns have been confirmed, the unknown exploitation history underscores the urgency for immediate action.

Widespread Impact on Apple’s Ecosystem

The vulnerability’s broad reach spans Apple’s core operating systems and browser. JavaScriptCore, the engine powering Safari and other web rendering in iOS, macOS, tvOS, and watchOS, processes dynamic web elements like scripts and animations.

An attacker could craft a booby-trapped webpage or email link to trigger the flaw, bypassing traditional defenses. Older devices, such as those running iOS 15 or earlier macOS versions, are particularly vulnerable if they haven’t received updates.

CISA warns that end-of-service (EoS) products no longer supported by Apple offer no patch path, leaving users exposed indefinitely.

For cloud-integrated services, CISA references Binding Operational Directive (BOD) 22-01, urging federal agencies and critical infrastructure operators to apply mitigations or retire affected systems.

Private users face similar risks, especially in hybrid work environments where personal Apple devices handle sensitive data.

CISA’s directive is clear: Update to the latest vendor-patched versions immediately. Apple released fixes in security updates dating back to early 2023, but users must verify their systems via Settings > General > Software Update.

If mitigations aren’t feasible, particularly for EoL hardware, the agency advises discontinuing use to avoid exploitation. Network defenders should monitor for anomalous JavaScript activity and enforce endpoint detection rules targeting code execution attempts.

Recent reports indicate that attacks on Apple platforms are surging by 20% year over year, making staying vigilant non-negotiable. Organizations delaying patches risk cascading breaches, while individuals should prioritize updates to safeguard their digital lives.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.