Apple users at risk: CERT-In flags major security risk in iOS, macOS & more

India's Computer Emergency Response Team (CERT-In) has issued a critical security warning affecting a broad range of Apple devices. The advisory highlights multiple vulnerabilities across Apple’s operating systems and key applications that could potentially expose users to risks such as data theft, privilege escalation, and total device compromise if not addressed promptly. The vulnerabilities primarily impact iPhones and iPads running versions prior to iOS and iPadOS 26.1, along with several versions of macOS, including Sequoia before 15.1, Ventura before 13.7.1, and Monterey before 12.7.2. Additionally, older iterations of watchOS, tvOS, visionOS, Safari, and Xcode are also at risk. These security issues originate from weaknesses in essential components like the Kernel, WebKit, CoreAnimation, and Siri. CERT-In notes that these flaws are associated with numerous CVE identifiers, indicating that they could be exploited by attackers to execute arbitrary code, escalate privileges, access sensitive information, bypass built-in safeguards, or even cause denial-of-service attacks. The agency's advisory underscores the substantial risks of unauthorized access to confidential data, service interruptions, and complete system takeovers. The potential ramifications include data breaches, malware dissemination, and system failures, affecting both individual users and organizations that depend on Apple devices for their operations. Devices that have not been updated to the latest versions of iOS, iPadOS, macOS, watchOS, tvOS, visionOS, Safari, and Xcode are particularly vulnerable. To mitigate these risks, CERT-In strongly advises all users to install the latest updates provided by Apple, specifically iOS and iPadOS 26.1, along with the necessary patches for other platforms. This action will address the identified vulnerabilities and enhance security measures. The agency further recommends enabling automatic updates, downloading apps solely from trusted sources, and avoiding suspicious links to lower the risk of targeted attacks. CERT-In’s comprehensive advisory warns that if these vulnerabilities remain unresolved, they could lead to severe security issues such as memory corruption, data manipulation, and more. Users are urged to act swiftly to protect their devices from potential threats.