CVE-2019-6223 is a group facetime vulnerability in Apple iOS and macOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient’s Apple device to answer unknowingly or without user interaction.
What CVE-2019-6223 Means for Group FaceTime
CVE-2019-6223 is dangerous because it affects a trusted communication feature in Apple iOS and macOS: a call initiator could cause the recipient’s device to answer without the user clearly choosing to accept the call. That breaks the normal expectation that a live audio or video session begins only after intentional consent.
For users and organisations, the security problem is not just the software bug itself. It is the way a flawed call-answering path can turn a familiar collaboration tool into an unexpected access channel, especially on devices used for executive communication, incident response, or sensitive conversations.
Why This Vulnerability Was Security-Relevant
This class of flaw matters because it undermines the trust boundary around interactive communications. A feature designed to establish a call can instead trigger connection behaviour that the recipient did not explicitly approve, which creates confusion about whether a session is truly user-initiated.
That kind of weakness is especially risky in mobile and desktop ecosystems where people assume built-in calling features are safer than third-party apps. When a platform component behaves unexpectedly, the impact can extend beyond nuisance into privacy exposure, conversation interception, or social-engineering support for follow-on abuse.
Apple’s own advisory and the CVE Program remain the best sources for canonical record details, while the NIST National Vulnerability Database is the place to track the vulnerability entry as a reference point for broader vulnerability management.
How Organisations Check Exposure and Limit Harm
Exposure assessment starts with knowing which Apple endpoints are in service, who uses FaceTime-enabled devices, and whether those devices are internet-reachable or used for sensitive communications. A device may be technically vulnerable even if the organisation does not treat FaceTime as a business-critical application.
If patching is delayed, administrators should treat the feature as a potential exposure point and reduce reliance on it for high-sensitivity conversations. That usually means tightening endpoint policy, limiting unexpected inbound call handling where feasible, and using alternate approved channels for confidential contact until the affected devices are updated.
For prioritisation, a vulnerability-management process helps connect the issue to asset inventory, internet exposure, and remediation urgency. NHIMG’s Vulnerability Management Guide is useful here because it frames how KEV-listed issues should move quickly through triage, exceptions, verification, and closure.
Detection, Remediation, and Post-Exploitation Review
After remediation, organisations should review whether the affected devices were used in situations where an unexpected FaceTime answer could have exposed audio, video, or call metadata. The concern is not only whether the bug exists, but whether it was actually used before it was corrected.
That review should include device logs and user reports for unusual inbound call behaviour, unexplained call acceptance, or any sign that a device joined a conversation unexpectedly. Where the organisation stores sensitive call-related information, post-patch review should also consider whether the event created a privacy incident or enabled follow-on social engineering.
In practice, vulnerability closure is only complete when exposure has been reduced and there is reasonable confidence that no pre-remediation misuse remains on the device or in the surrounding communication workflow.
Risk and Threat Considerations
This vulnerability is material because it can convert a routine calling feature into an unanticipated entry point for eavesdropping, coercion, or conversation disruption. In a managed environment, the main risk is that users assume they are in control of call acceptance when the device may have behaved differently.
Failure mechanism: The recipient device responds to an incoming FaceTime call in a way that bypasses normal user intent, which can create an active session without clear consent.
Impact: Attackers or misusers can gain a path to privacy exposure, social-engineering leverage, or unwanted participation in a live communication, especially before the issue is patched.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CVE-2019-6223 is a KEV-listed vulnerability that needs prioritised remediation. |
| Recommendation — Prioritise and remediate the vulnerable Apple devices before lower-risk findings. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires timely flaw remediation on affected Apple endpoints. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure checking depends on identifying affected Apple assets and validating status. | |
| Recommendation — Track, assess, and remediate the vulnerability on in-scope devices. Scan and inventory Apple endpoints to confirm where the flaw exists. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities are Identified and Recorded | The subject requires identifying vulnerable Apple assets and recording exposure. |
| PR.DS-01 — Data-at-rest is protected | Unexpected call acceptance can expose sensitive communication content, supporting protection of data handling paths. | |
| Recommendation — Record exposed Apple devices and drive remediation based on that inventory. Protect sensitive communications by limiting exposure on affected devices. | ||
Practitioner Guidance
Why practitioners should care: Treat this kind of bug as both a patching issue and a communication-trust issue. A platform calling feature that answers unexpectedly can undermine user confidence in the device and in the organisation’s approved collaboration workflow.
What to watch for: Look for devices that remain unpatched, users who rely on FaceTime for sensitive discussions, and any reports of calls appearing connected without deliberate acceptance. Those are the conditions that justify faster remediation and a post-incident review of device use.