The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after receiving evidence that attackers are using the Apple flaw in live campaigns. The move confirms that a vulnerability Apple patched in 2024 remains a practical risk for devices that have not received the relevant updates.
CVE-2024-27834 is an improper-authentication vulnerability affecting Apple platforms and Safari. An attacker who already has arbitrary read and write capability on a device can use it to bypass Pointer Authentication, a hardware-backed defense intended to prevent unauthorized control-flow and memory-corruption attacks. The National Vulnerability Database assigns the issue a CVSS 3.1 score of 5.5, or medium severity, with a local attack vector and low attack complexity.
The vulnerable products include Safari versions earlier than 17.5, iOS and iPadOS versions earlier than 16.7.8 or 17.5, macOS Sonoma versions earlier than 14.5, tvOS versions earlier than 17.5 and watchOS versions earlier than 10.5, according to NVD’s record. Apple addressed the issue with improved checks in security releases issued in May 2024; the vendor’s security advisories are linked from the NVD entry.
The exploitation evidence follows research into a watering-hole campaign that delivered platform-specific exploit chains through compromised legitimate websites, lookalike sites and a compromised Plerdy SEO Tracker script. SecurityWeek’s account of the research says the iOS chain combined CVE-2024-27834 with another vulnerability to bypass Pointer Authentication and execute code capable of stealing Safari cookies. Researchers attributed the activity to APT29, also known as Cozy Bear and Midnight Blizzard, although that attribution remains a reported assessment rather than a finding by CISA.
The campaign’s use of compromised web infrastructure is significant because victims may need only to visit a poisoned or impersonated site for the attackers to profile the device and select an exploit chain. Organizations should inventory Apple hardware, force updates where supported and investigate potentially exposed devices for suspicious browser sessions, stolen cookies or other signs of compromise. CISA’s alert says federal civilian agencies must prioritize catalog vulnerabilities under its current risk-based requirements and encourages all other organizations to do the same.
