CISA adds Apple flaw CVE-2024-27834 to Known Exploited Vulnerabilities catalog

Security Affairs reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Apple flaw CVE-2024-27834, which has a CVSS score of 5.5, to its Known Exploited Vulnerabilities (KEV) catalog. According to the article, the flaw could allow an attacker who already has arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC), a hardware-based mechanism designed to prevent certain memory-corruption attacks. Apple fixed the vulnerability in Safari 17.5, iOS 16.7.8 and iOS 17.5, iPadOS 16.7.8 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.

Cybersecurity firm Sekoia reports attacks attributed with moderate to high confidence to the Russia-linked cyberespionage group APT29. According to Sekoia, the attackers used compromised websites, fake websites and a supply-chain compromise of Plerdy SEO Tracker to deliver malicious JavaScript, and the zero-click exploit chain used the flaw to bypass PAC and deploy information-stealing malware. CISA orders federal agencies to fix the flaw by 18 November 2026, under Binding Operational Directive (BOD) 22-01.

Why it matters Organizations running Apple operating systems and Safari should check whether they have installed the fixed versions listed by Apple, since the flaw is now listed as exploited in the KEV catalog. Per the article, the flaw is a PAC bypass that is part of a zero-click chain used by APT29 against Safari and Chrome, so security teams should treat it as one step in a broader intrusion rather than an isolated bug. Investigators reviewing browser-based compromises should consider whether the supply-chain compromise of Plerdy SEO Tracker or similar third-party scripts were present in their environment.