CISA adds exploited Apple PAC bypass CVE-2024-27834 to KEV
Original title: U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
CISA added Apple CVE-2024-27834, CVSS 5.5, to the Known Exploited Vulnerabilities catalog. An attacker who already has arbitrary read and write access can bypass Pointer Authentication, weakening defenses against memory corruption. Apple fixed it with improved checks in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Sekoia says a zero-click chain used compromised and fake sites plus a Plerdy SEO Tracker supply-chain compromise to steal browser cookies and device data, and used this flaw to forge valid pointers.
Unconfirmed: Sekoia attributes the attacks to APT29 only with moderate to high confidence.
- CISA ordered FCEB agencies to remediate CVE-2024-27834 by November 18, 2026.
- The bug alone does not grant code execution; it bypasses PAC after arbitrary memory access.
- Sekoia says the chain targeted Safari and Chrome vulnerabilities.
- Delivery used compromised websites, fake websites and malicious JavaScript.
- The malware collected browser cookies and device data.
Impact: Bypass Pointer Authentication after arbitrary memory read and write
| Product | Affected | Fixed in |
|---|---|---|
| Apple Safari | — | 17.5 |
| Apple iOS | — | 16.7.8 and 17.5 |
| Apple iPadOS | — | 16.7.8 and 17.5 |
| Apple macOS Sonoma | — | 14.5 |
| Apple tvOS | — | 17.5 |
| Apple watchOS | — | 10.5 |
- 1.Install the listed Apple updates, including Safari 17.5 and the named OS releases.
- 2.FCEB agencies must remediate CVE-2024-27834 by November 18, 2026.
- CVEs
- CVE-2024-27834
- ATT&CK
- T1189 Drive-by CompromiseT1195.002 Compromise Software Supply ChainT1059.007 JavaScriptT1539 Steal Web Session Cookie
- Vendors
- Apple
- Threat actors
- APT29
- Countries
- RussiaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.