CVE-2019-6223: Apple iOS and macOS Group Facetime Vulnerability

CVE-2019-6223 is a vulnerability in Apple Group FaceTime on iOS and macOS. It allows the initiator of a Group FaceTime call to cause the recipient's Apple device to answer the call unknowingly or without any user interaction. This matters because it can expose live audio or video from the recipient's device without their knowledge or consent, creating a direct privacy and confidentiality risk for users and organizations that rely on these platforms.

Defenders should treat this as a high-priority privacy issue on managed Apple endpoints. Confirm all version and patch details against the current Apple vendor advisory, as public technical detail on the exact flaw is limited.

How it works

The CWE for this issue is not specified in available records. At a high level, the vulnerability resides in Group FaceTime handling on Apple iOS and macOS. An attacker who can place a Group FaceTime call is able to force the recipient device into an answered state without the normal user prompt or interaction. This bypasses the expected consent model for incoming calls.

In practical terms, the call initiator triggers the condition; the recipient's microphone (and potentially camera) can become active while the user remains unaware. No further exploit mechanics, preconditions, or code-level details are provided in the public summary, so teams should not assume specific attack chains beyond what the vendor describes. The core abuse is unauthorized activation of the call session on the target device.

Am I affected? How to find it in your systems

The vulnerability affects Apple iOS and macOS systems that support Group FaceTime. These platforms commonly appear as employee iPhones, iPads, and Macs in both corporate and BYOD environments, as well as shared or kiosk devices.

Inventory steps:

• Use mobile device management (MDM) or endpoint management tools to enumerate all enrolled iOS and macOS devices.
• Identify devices with FaceTime enabled or with recent Group FaceTime usage in configuration profiles or app inventories.
• Compare installed OS builds against the fixed versions listed in Apple's advisory for CVE-2019-6223; do not rely on generic version ranges.
• Review network or MDM logs for unexpected FaceTime or related media traffic originating from devices that show no corresponding user activity.

Telemetry signs of possible exploitation are limited because the flaw involves silent call acceptance. Look for FaceTime process activity, unexpected microphone or camera access events, or call logs that lack matching user-initiated actions. Confirm detection guidance in the vendor advisory, as no specific indicators are supplied in the public summary.

How to remediate

Patch first. Apply the updates Apple released for this vulnerability exactly as directed in the vendor advisory. CISA guidance is to apply updates per vendor instructions. Use MDM or Apple Business Manager workflows to push the fixed iOS and macOS builds to all managed devices as quickly as possible, and verify installation success.

After patching, harden the FaceTime attack surface for this class of issue:

• Restrict or disable FaceTime via configuration profiles where business use is not required.
• Enforce least-privilege camera and microphone permissions.
• Ensure devices remain under continuous management so future FaceTime-related fixes can be deployed rapidly.
• Educate users that unexpected call behavior should be reported immediately.

Re-inventory after the rollout to confirm no unpatched systems remain.

If you can't patch immediately

If immediate patching is blocked, apply compensating controls to reduce exposure until the vendor update can be installed:

• Disable Group FaceTime or FaceTime entirely through MDM profiles on affected device groups.
• Segment Apple devices onto restricted network zones that limit outbound media and signaling traffic where feasible.
• Monitor for anomalous FaceTime process starts, microphone/camera activation events, or call-related network connections that lack user context.
• Consider temporary virtual patching or outbound filtering of FaceTime-related destinations if your network controls support it, while recognizing that client-side flaws are only partially mitigated this way.
• Prioritize high-risk users (executives, remote workers, devices with sensitive data) for manual updates or temporary device quarantine.

These steps lower risk but do not replace the official patch. Track the advisory and schedule the update without delay.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to unauthorized audio or video capture and subsequent data exposure or broader compromise. Known ransomware use is not documented for this CVE. If you suspect devices were targeted, preserve logs, isolate affected endpoints, and follow your incident response process. Users and administrators can also run a free exposure scan of their email addresses against known breach data sets to check for related credential or personal information exposure.