CISA Adds Exploited Apple Pointer Authentication Flaw to KEV
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2024-27834, an Apple vulnerability with a CVSS score of 5.5, to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The flaw affects multiple Apple operating systems and was patched by Apple in May 2024.
CVE-2024-27834 is an improper-authentication issue. An attacker with arbitrary read and write capability could use it to bypass Pointer Authentication, a hardware-backed protection mechanism. The bug was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024.
Apple releases affected by the flaw
Apple addressed the vulnerability through improved checks in iOS 16.7.8 and iPadOS 16.7.8; iOS 17.5 and iPadOS 17.5; macOS Sonoma 14.5; tvOS 17.5; watchOS 10.5; and Safari 17.5. Organizations need to establish whether managed devices reached the applicable version, rather than treating the issue as limited to phones or desktops.
CISA’s catalog entry places the bug among vulnerabilities known to be used in attacks. For Federal Civilian Executive Branch agencies, the remediation deadline is November 18, 2026.
Browser exploitation and information theft
The KEV addition follows research from Sekoia into campaigns that abused previously patched Safari and Google Chrome vulnerabilities to deliver malware designed to harvest browser and device data. Sekoia attributed the activity to APT29, also called Cozy Bear and Midnight Blizzard, with moderate to high confidence. The group is described as state-sponsored and affiliated with Russia’s Foreign Intelligence Service.
The reported operations used three initial-access paths: compromised legitimate websites, fake websites impersonating popular destinations, and a supply-chain attack targeting Plerdy SEO Tracker. These routes served malicious JavaScript, profiled a visitor’s device, triggered exploitation, and then delivered an information-stealing payload.
Zero-click chain targets browser data
The reported zero-click chain combines CVE-2025-43529, described as a WebKit remote-code-execution issue, with a pointer authentication codes bypass. The resulting JavaScript payload is intended to steal browser cookies. Browser cookies can be sensitive because they may carry authenticated session data.
The source describes CVE-2025-43529 twice in connection with both the WebKit issue and the PAC bypass, while CISA’s KEV action specifically identifies CVE-2024-27834. Teams should therefore use Apple’s listed fixed releases and CISA’s catalog entry when matching the patch requirement to device inventories.
What security teams should do
Security teams should verify deployment of the relevant Apple updates, prioritize devices that browse externally accessible sites, and review alerts associated with unusual JavaScript activity or browser-cookie theft. The practical business implication is that timely patch verification across Apple endpoints and browsers is necessary when exploitation can begin through ordinary web visits or compromised third-party services.