CISA has added a medium-severity Apple flaw that was fixed in May 2024 to its Known Exploited Vulnerabilities catalog, citing active exploitation. The bug, CVE-2024-27834, is a Pointer Authentication bypass rated 5.5 on the CVSS scale that lets an attacker who already has arbitrary read and write capability get past the protection. Federal civilian agencies have until November 18 to apply fixes.
Apple’s fixes shipped in iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. The flaw was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
The listing follows a Sekoia report, summarized by The Hacker News, that ties a suspected Russia-linked group known as APT29, Cozy Bear and Midnight Blizzard to a campaign built on older Safari and Chrome flaws. Sekoia makes that attribution with moderate to high confidence. Victims were reached through compromised legitimate websites, fake sites impersonating popular ones and a supply chain attack on the Plerdy SEO Tracker. Malicious JavaScript profiled each visitor’s device before triggering a zero-click exploit chain and installing malware that steals browser cookies and device data.
The age of the bug is the point. Devices that skipped the 2024 updates remain exposed, and a medium score on paper says little about how a flaw behaves once it is chained with others. Teams that manage Apple fleets should confirm that every iPhone, iPad, Mac and browser is on a current release instead of trusting patch records from two years ago.