PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4689 Apple CVE debrief

CVE-2016-4689 describes a trust-validation issue in Apple iOS Mail: the client did not alert users when an S/MIME-signed email used a revoked certificate. The issue was published by NVD on 2017-02-20 and is associated with iOS versions before 10.2. Because the problem affects how signed email authenticity is presented to the user, it can undermine integrity decisions even when the message is otherwise delivered normally.

Vendor
Apple
Product
CVE-2016-4689
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Organizations and individuals using Apple iOS Mail, especially environments that rely on S/MIME for signed email trust decisions, certificate revocation enforcement, or secure messaging workflows.

Technical summary

NVD describes the weakness as Apple Mail failing to alert the user to an S/MIME email signature that used a revoked certificate. The NVD CPE criteria mark iPhone OS through 10.1.1 as vulnerable, while the CVE description states iOS before 10.2 is affected. NVD assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a network-reachable issue with high integrity impact and no confidentiality or availability impact. The primary weakness classification recorded by NVD is CWE-254.

Defensive priority

High

Recommended defensive actions

  • Update affected iOS devices to iOS 10.2 or later.
  • Review Apple’s security guidance for the issue in HT207422 and confirm remediation is deployed across managed devices.
  • If S/MIME is required in your environment, verify mail-client behavior still surfaces certificate revocation warnings after patching.
  • Prioritize devices used for sensitive or authenticated email workflows, since the impact is on trust and message integrity.

Evidence notes

This debrief is based on the supplied NVD record and linked vendor references. The CVE description states the issue affects iOS before 10.2 and concerns Mail failing to alert on an S/MIME signature using a revoked certificate. NVD metadata lists a vulnerable CPE range ending at iPhone OS 10.1.1, CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, and CWE-254. Referenced URLs include the CVE record, NVD detail page, Apple support advisory HT207422, and third-party reference entries.

Official resources

Originally published in the CVE/NVD record on 2017-02-20. The supplied NVD entry was last modified on 2026-05-13; that modification date is metadata about the record, not the issue's discovery date.