Is CVE-2019-6223 (Apple iOS and macOS Group Facetime) being exploited in the wild?

Yes. CISA added CVE-2019-6223 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient’s Apple device to answer unknowingly or without user interaction.

What CVE-2019-6223 Means Operationally for Apple Devices

CVE-2019-6223 matters because it is not just a theoretical flaw, it is a publicly tracked weakness in Apple iOS and macos group facetime that CISA says has been actively exploited. For defenders, the key question is whether any Apple estate still exposes the vulnerable feature set, whether the associated devices are still reachable, and whether exposed endpoints have been checked for signs of abuse.

Because the vulnerability involves call behaviour on the device itself, the practical security issue is not only whether an attacker can trigger the condition, but whether users and support teams can trust that a device behaved normally during a FaceTime interaction. That makes exposure review, patch status, and incident review the first operational priorities.

Why KEV Listing Changes the Triage Threshold

CISA KEV inclusion changes this from a generic vulnerability record into an active-response item. A KEV-listed issue should be treated as an exploitation signal, so patching and containment should move ahead of lower-priority backlog items, especially on managed fleets where Apple endpoints may be spread across employees, executives, and shared services.

For verification and prioritisation, use the public vulnerability record and KEV listing as the authoritative references for the issue, then confirm whether your inventory still includes affected Apple versions or unmanaged devices that do not reliably receive enterprise updates. NIST National Vulnerability Database remains the best starting point for the canonical CVE record, while CISA Known Exploited Vulnerabilities Catalog is the place to confirm exploitation status and remediation expectations.

What to Check Before You Assume the Fleet Is Safe

Do not stop at “the vendor fixed it long ago.” Fleet assurance requires confirming which devices are still in scope, whether they are supervised or unmanaged, and whether any exceptions or delayed updates exist. If the affected feature is present on devices that have not been centrally governed, the practical risk is that the estate can remain exposed long after the public disclosure has faded.

Confirm which iPhone, iPad, and Mac models are still deployed.
Verify patch compliance on all managed endpoints, including offline or rarely connected devices.
Review whether FaceTime is permitted where business use is unnecessary.
Check logs and helpdesk reports for unexplained call acceptance or user complaints around FaceTime behaviour.

Risk and Threat Considerations

The main risk is silent abuse of a trusted communication feature. If an attacker can trigger unexpected answering or user interaction bypass on a reachable device, the user’s normal expectation of consent and control is weakened, which increases the chance of social engineering, surveillance, or follow-on exploitation in a managed mobile estate.

Failure mechanism: The flaw is exploitable because the call handling path can be induced to act without normal user awareness, so the security boundary is the trust placed in the incoming call workflow rather than a separate authentication step.

Impact: Attackers can gain an unexpected interaction path into a device, which may enable privacy intrusion, user confusion, or chaining into broader compromise if the device is already exposed through other weaknesses.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Identity of assets and systems	Asset inventory is needed to find exposed Apple endpoints.
	PR.PS-01 — Configuration management	Patch status and managed configuration determine exposure to a known exploited flaw.
	DE.CM-01 — Networks and network services are monitored	Monitoring helps spot suspicious device behavior after exploitation.
Recommendation — Inventory every Apple device and confirm whether it remains in scope. Enforce approved update settings and close patch exceptions quickly. Review telemetry and logs for anomalous FaceTime-related activity.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exposure requires current vulnerability identification and triage.
	CM-8 — System Component Inventory	You must know which Apple devices are deployed to verify exposure.
Recommendation — Continuously identify exposed endpoints and prioritize KEV-listed findings. Maintain an accurate inventory of all Apple endpoints and their patch state.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited issues should be prioritized within vulnerability management.
	CIS-12 — Network Infrastructure Management	Mobile device exposure and control depends on managed endpoint configuration and access paths.
Recommendation — Prioritize KEV-listed vulnerabilities for rapid remediation and verification. Restrict unnecessary service exposure and enforce centralized device management.

Practitioner Guidance

What to prioritise: Treat every KEV-listed Apple mobile or desktop issue as an endpoint governance problem, not just a patching problem. Prioritise devices that are user-facing, frequently used for communications, or outside strict MDM control, because those are the endpoints most likely to carry residual exposure.

What to verify: Confirm that remediation is complete on the full fleet, then validate that the issue did not coexist with other signs of compromise. If patching was delayed, review relevant telemetry, user reports, and incident tickets for anomalies around FaceTime calls or unexplained device behaviour.

Practitioner takeaway: When a vulnerability is already in CISA KEV, the decision is not whether it is worth attention, but whether your device inventory, update enforcement, and compromise review are good enough to prove it is no longer exploitable.