WORLDTECHCISA adds actively exploited Apple flaw CVE-2024-27834 to KEV catalog
The US Cybersecurity and Infrastructure Security Agency has added an improper authentication flaw affecting several Apple products to its known exploited vulnerabilities list, according to a report by SC Media. The bug, rated CVSS 5.5, is reportedly tied to Russian nation-state campaigns.
Flaw affects several Apple platforms
The vulnerability, catalogued as CVE-2024-27834, affects Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, according to the report. CISA says an attacker with arbitrary read and write capability could use it to bypass pointer authentication, a protective mechanism in Apple's software.
Link to Russian cyberespionage
The flaw was reportedly exploited in the wild and is linked to campaigns by Russian nation-state actors such as APT29, also known as Midnight Blizzard, which used watering-hole and zero-click exploit chains. Jason Soroko, senior fellow at Sectigo, said CISA added the flaw after finding evidence of active exploitation.
Why the medium rating matters
Soroko argued that the 5.5 severity score should not outweigh that evidence when organisations set patch priorities, because the flaw lets an attacker who can already read and alter memory get past a defence. Steve Zurier's report quotes an analyst, Ursry, who warned that prioritising only high or critical vulnerabilities could leave the components of an attack unpatched.
Patch gaps remain a concern
Apple released a fix in May 2024. Ursry said the flaw was chained with vulnerabilities patched in 2025, so organisations should identify Macs, iPhones and iPads that have missed updates, using device management and access records. Soroko advised teams to assess whether affected devices were compromised before patching and, where theft is suspected, to investigate account activity and revoke sessions.
Open questions
- Which affected devices remain unpatched across organisations?
- Were any devices compromised before they were updated?