PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7662 Apple CVE debrief

CVE-2016-7662 is an Apple certificate-validation weakness in the Security component. In affected iOS, macOS, and watchOS releases, a remote attacker could spoof certificates, weakening trust in encrypted connections and enabling man-in-the-middle style deception. Apple’s fixed releases are the relevant defensive action for exposed devices.

Vendor
Apple
Product
CVE-2016-7662
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple device owners, enterprise mobility teams, and security administrators responsible for iPhone, iPad, Mac, and Apple Watch fleets running older operating system releases. Any environment that depends on certificate-based trust for secure communications should treat this as important.

Technical summary

NVD classifies the issue as CWE-295 (Improper Certificate Validation) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The public description states that the Apple Security component allowed remote attackers to spoof certificates via unspecified vectors. The affected versions listed in the CVE description are iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3.

Defensive priority

High. This is a remotely reachable trust-validation issue with no privileges or user interaction required, and it can undermine the authenticity of secure connections.

Recommended defensive actions

  • Upgrade iOS devices to 10.2 or later.
  • Upgrade macOS systems to 10.12.2 or later.
  • Upgrade Apple Watch devices to 3.1.3 or later.
  • Prioritize updates for systems that handle sensitive web, app, or enterprise traffic over TLS.
  • Verify that fleet management, patch compliance, and certificate-pinning controls are functioning as expected after remediation.

Evidence notes

The supplied NVD record identifies Apple as the vendor, lists CWE-295, and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The CVE description explicitly states that iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3 are affected, and that the issue involves the Security component allowing remote certificate spoofing. No exploit details were provided in the supplied corpus.

Official resources

Publicly disclosed and published in the supplied CVE record on 2017-02-20. The supplied NVD record was last modified on 2026-05-13. No KEV entry is indicated in the supplied data.