The Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited critical Apple iOS zero-day vulnerability to their Known Exploited Vulnerabilities (KEV) catalog this week. If exploited, this flaw could allow malicious threat actors to execute arbitrary code on vulnerable devices. The vulnerability affects certain models of the iPhone, iPad Air, iPad Pro, and iPad Mini. This flaw, tracked as CVE 2023-23529, can be exploited by threat actors through social engineering attacks. An attacker could send the victim a phishing link via email, SMS, messaging applications, or embedded QR codes. If a threat actor was able to trick the victim into granting them initial access to the vulnerable device, they could then execute arbitrary code that downloads malware, giving the threat actor complete control of the device and the user’s data. This vulnerability’s presence on the KEV means that all non-military Federal Civilian Executive Branch (FCEB) agencies with vulnerable iOS devices have until March 7, 2023, to patch the flaw with iOS’s latest update, or risk being fined by regulators. CTIX analysts recommend that any readers with vulnerable devices ensure that they are running the most recent secure version of iOS.