CISA adds Apple flaw linked to APT29 to its exploited list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Apple flaw CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog. The advisory notes a CVSS score of 5.5 and describes the flaw as a vulnerability that could allow an attacker who already has arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) — a hardware-based protection that cryptographically signs pointers to guard memory against certain memory-corruption attacks.

The impact includes bypassing PAC protections, weakening memory-defence mechanisms, and potentially enabling further exploitation when combined with other vulnerabilities. Apple patched the issue in multiple releases, including Safari 17.5, iOS 16.7.8 and iOS 17.5, iPadOS 16.7.8 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.

CISA’s inclusion of CVE-2024-27834 highlights the ongoing risk to federal networks and private sector infrastructure, with agencies required to address the vulnerability by a due date of 18 November 2026 under Binding Operational Directive 22-01.

Evidence cited by cybersecurity firm Sekoia links the vulnerability to activity attributed with moderate to high confidence to Russia-linked APT29. The group is described as using compromised or fake websites and a supply-chain incident involving the Plerdy SEO Tracker to deliver malicious JavaScript, forming a zero-click exploit chain that targets Safari and Chrome to bypass protections and deploy information-stealing malware capable of harvesting browser cookies and device data.

The advisory also reiterates guidance from CISA and DHS-ending obligations under the KEV catalog, and notes the vigilance expected of federal and private organisations in reviewing and remediating the flagged vulnerabilities.