PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7651 Apple CVE debrief

CVE-2016-7651 describes an Apple Accounts component issue where mishandling an app uninstall could let a local user bypass intended authorization restrictions. NVD scores it Medium (CVSS 5.3) with local attack conditions, low privileges, and no user interaction, which makes it a meaningful on-device access-control bypass rather than a remote compromise. The supplied corpus points to affected iOS and watchOS releases, but the exact version bounds differ between the narrative description and the NVD CPE entries, so remediation should be verified against Apple’s advisories.

Vendor
Apple
Product
CVE-2016-7651
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Security teams managing iPhones and Apple Watches, especially MDM administrators, endpoint compliance owners, and anyone responsible for devices that may be locally accessible or shared.

Technical summary

The vulnerability is in Apple’s Accounts component and is categorized as CWE-285 (improper authorization). The NVD vector indicates AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, consistent with a local privilege/authorization bypass triggered through app uninstall handling. The corpus references Apple advisories for iOS and watchOS remediation.

Defensive priority

Medium priority. Patch promptly on any device still running a version in the affected range, especially if local access is possible or authorization controls are important to your environment.

Recommended defensive actions

  • Update affected iOS and watchOS devices to the vendor-fixed releases referenced by Apple’s advisories.
  • Use MDM or compliance tooling to inventory devices below approved OS baselines and block access until patched.
  • Validate the exact vulnerable version range directly against Apple’s advisories before operationalizing remediation windows.
  • Review local access controls and device-sharing practices on endpoints where authorization bypasses would have elevated impact.

Evidence notes

Canonical timing comes from the supplied CVE publication date (2017-02-20) and NVD modification date (2026-05-13). NVD lists Apple vendor advisories and third-party references, and its CVSS vector is CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L with weakness CWE-285. The supplied corpus contains a version-range inconsistency: the narrative description says iOS before 10.2 and watchOS before 3.1.1, while the NVD CPE criteria list iPhone OS through 10.1.1 and watchOS through 2.2.2.

Official resources

Publicly recorded in NVD on 2017-02-20 and later modified on 2026-05-13; the NVD entry cites Apple vendor advisories as primary references.