CISA Adds Exploited Apple Flaw to Its KEV Catalog

CISA added the patched Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on 4 November 2026, after reports that threat actors were actively exploiting it. CVE-2024-27834 is an improper authentication flaw with a CVSS of 5.5 that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication.

Apple had previously addressed the issue in May 2024 with enhanced checks across iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. The flaw was demonstrated as a zero‑day at Pwn2Own Vancouver in March 2024. The KEV listing follows a Sekoia report indicating that threat actors possibly linked to Russia exploited patched Safari and Google Chrome vulnerabilities to deploy data‑harvesting malware.

The attacks have been attributed to APT29 (Cozy Bear/Midnight Blizzard) with moderate to high confidence. They reportedly used three initial access vectors—compromised legitimate websites, fake sites masquerading as popular sites, and a supply chain attack against Plerdy SEO Tracker—to serve malicious JavaScript that triggers the vulnerability and then deploys an information‑stealing payload after profiling the visitor’s device.

The exploit chain is described as zero‑click, combining CVE-2025-43529 (WebKit remote code execution) and PAC bypass to execute a JavaScript payload designed for browser cookie theft. In light of active exploitation, FCEB agencies are advised to apply the necessary patches by 18 November 2026.