CISA Adds Patched Apple Flaw CVE-2024-27834 to KEV After Exploitation Reports
Summary
CISA added Apple flaw CVE-2024-27834 to its KEV catalog after active-exploitation reports. Sekoia linked the activity with moderate-to-high confidence to APT29 and described malware delivery through several website and supply-chain pathways.
Key points
- CVE-2024-27834 is an improper-authentication flaw that can allow an attacker with arbitrary read and write capability to bypass Pointer Authentication; it has a CVSS score of 5.5.
- Apple patched the flaw in May 2024 across specified iOS, iPadOS, macOS, tvOS, watchOS, and Safari releases.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
- Sekoia reported that threat actors possibly linked to Russia exploited previously patched Safari and Chrome vulnerabilities to deliver malware that harvests browser and device data.
- The activity was attributed to APT29, also known as Cozy Bear and Midnight Blizzard, with moderate-to-high confidence.
- Reported delivery paths included compromised legitimate websites, fake sites impersonating popular websites, and a supply-chain attack targeting Plerdy SEO Tracker.
- Federal Civilian Executive Branch agencies were advised to apply the patches by November 18, 2026.
Article Details
- Vulnerability Types
- Improper authentication
- Pointer Authentication bypass
- Remote code execution
- Severity
- Medium (CVSS 5.5)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.007 · JavaScriptMalicious JavaScript triggered the vulnerability and included a payload designed for browser cookie theft.T1189 · Drive-by CompromiseThe reported attack used compromised legitimate websites and fake sites masquerading as popular websites to serve malicious JavaScript.T1195.002 · Compromise Software Supply ChainOne initial access pathway was a supply chain attack aimed at Plerdy SEO Tracker.T1203 · Exploitation for Client ExecutionThe exploit chain used browser vulnerabilities, including a WebKit remote code execution flaw and a Pointer Authentication bypass, to deploy malware.T1539 · Steal Web Session CookieThe JavaScript payload was designed to steal browser cookies.
CVE
CVE-2024-27834Apple · iOS and iPadOS; apple · ipad_os; +5 moreThe vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication.CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreThe zero-click exploit chain combines CVE-2025-43529, a remote code execution flaw in WebKit, and CVE-2025-43529, the pointer authentication codes (PACs) bypass, to execute a JavaScript payload designed for browser
Threat Actors
Cozy BearThe article identifies Cozy Bear as an alias of APT29, which was attributed the reported activity with moderate to high confidence.ICE RELICThe activity was attributed to APT29 with moderate to high confidence; the article reports exploitation of patched browser vulnerabilities to deliver information-stealing malware.Midnight BlizzardThe article identifies Midnight Blizzard as an alias of APT29, which was attributed the reported activity with moderate to high confidence.
Vendors
AppleSecurity Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of activeGooglethat threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data.
Products
Google Chromethreat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data.iOSIt was addressed by Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as aiPadOSIt was addressed by Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as amacOS Sonomaby Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day atPlerdy SEO Trackerwebsites, fake sites masquerading as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker – to serve malicious JavaScript that triggers the vulnerability and ultimately deploy theSafariiOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held intvOS2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2OwnwatchOSimproved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking