CISA Flags Apple Flaw CVE-2024-27834 Exploited by APT29

MW Contributor · 2026-11-09T20:40:47+08:00

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple security flaw to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. The flaw, tracked as CVE-2024-27834, affects multiple Apple operating systems and Safari. CISA listed it on 4 November 2026. Federal agencies in the United States must apply fixes by 18 November 2026. The listing followed a report from French cybersecurity firm Sekoia, which traced the attacks to a campaign it named Poisoned Source. Sekoia attributed the activity with moderate to high confidence to APT29, a state-sponsored hacking group linked to Russia's Foreign Intelligence Service. The group is also known as Cozy Bear and Midnight Blizzard. What the Apple vulnerability does CVE-2024-27834 is an improper authentication flaw. It lets an attacker who already has the ability to read and write memory on a device bypass Pointer Authentication. Pointer Authentication is a hardware defence built into Apple processors. It adds cryptographic signatures to memory addresses so the system can detect tampering. Bypassing it removes one of Apple's key barriers against memory corruption attacks. The flaw requires an attacker to already hold a degree of control over the device, which explains its moderate severity score of 5.5 on the CVSS scale. In real attacks, it was chained with another flaw that provided that initial access. Apple fixed the issue in May 2024 with improved checks. The fix was released in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. The vulnerability was first demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024 by researcher Manfred Paul, working with Trend Micro's Zero Day Initiative. How Russian hackers exploited a patched flaw Sekoia said the campaign used three ways to reach victims. The attackers injected malicious JavaScript into compromised legitimate websites. They built fake sites imitating popular destinations. They also compromised the Plerdy analytics tracker, a service loaded by thousands of mostly Ukrainian websites, between 27 August and 3 September. The injected script profiled each visitor first. It recorded the device model and browser version. A command-and-control server then chose the matching attack chain. The whole process needed no taps or clicks from the user. Against iPhones running iOS 16.7, the attackers combined CVE-2025-43529, a remote code execution flaw in the WebKit browser engine, with the CVE-2024-27834 bypass. The payload then swept Safari and third-party app containers for cookies and sent them to a server controlled by the attackers. Sekoia identified further chains against other outdated software. One targeted iPhones on iOS 18.5 with an exploit kit known as DarkSword, which harvested messages, photos, location data and stored credentials. Another targeted Android phones running affected versions of Chrome and stole cookies, saved logins, browsing history and Wi-Fi passwords. Most of the victim organisations were in Ukraine, with others in Europe and the United States. None of the chains work against devices running current software. Sekoia said the flaws were all previously patched n-day vulnerabilities, and noted that a user running an up-to-date operating system is safe from these attacks. What Apple users should do The CISA deadline applies only to U.S. federal agencies under Binding Operational Directive 26-04. However, CISA encourages every organisation to treat catalog entries as urgent, and the same logic applies to individual users. Any iPhone, iPad, Mac or Apple Watch updated to the May 2024 releases or later is protected. Devices stuck on older versions, especially models no longer receiving updates, carry the real risk. The campaign succeeded precisely because attackers bet that many devices would never receive the fix. Apple users can check their software version in Settings and install the latest available update. Updating to the newest supported release closes the flaw. The advice applies equally to users in Malaysia, since the attacks targeted anyone visiting the compromised websites, not one country. The case also shows why severity scores are a poor guide to real-world danger. A medium-rated flaw from 2024 became a working weapon for a state-sponsored group in 2026 because outdated devices stayed exposed long after the fix arrived.

This topic has 0 replies, 1 voice, and was last updated 1 day, 5 hours ago by MW Contributor.

Viewing 1 post (of 1 total)

Posts

November 9, 2026 at 8:40 pm
MW Contributor
Moderator
insert_chart
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple security flaw to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild.
The flaw, tracked as CVE-2024-27834, affects multiple Apple operating systems and Safari. CISA listed it on 4 November 2026. Federal agencies in the United States must apply fixes by 18 November 2026.
The listing followed a report from French cybersecurity firm Sekoia, which traced the attacks to a campaign it named Poisoned Source. Sekoia attributed the activity with moderate to high confidence to APT29, a state-sponsored hacking group linked to Russia’s Foreign Intelligence Service. The group is also known as Cozy Bear and Midnight Blizzard.
What the Apple vulnerability does
CVE-2024-27834 is an improper authentication flaw. It lets an attacker who already has the ability to read and write memory on a device bypass Pointer Authentication.
Pointer Authentication is a hardware defence built into Apple processors. It adds cryptographic signatures to memory addresses so the system can detect tampering. Bypassing it removes one of Apple’s key barriers against memory corruption attacks.
The flaw requires an attacker to already hold a degree of control over the device, which explains its moderate severity score of 5.5 on the CVSS scale. In real attacks, it was chained with another flaw that provided that initial access.
Apple fixed the issue in May 2024 with improved checks. The fix was released in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. The vulnerability was first demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024 by researcher Manfred Paul, working with Trend Micro’s Zero Day Initiative.
How Russian hackers exploited a patched flaw
Sekoia said the campaign used three ways to reach victims. The attackers injected malicious JavaScript into compromised legitimate websites. They built fake sites imitating popular destinations. They also compromised the Plerdy analytics tracker, a service loaded by thousands of mostly Ukrainian websites, between 27 August and 3 September.
The injected script profiled each visitor first. It recorded the device model and browser version. A command-and-control server then chose the matching attack chain. The whole process needed no taps or clicks from the user.
Against iPhones running iOS 16.7, the attackers combined CVE-2025-43529, a remote code execution flaw in the WebKit browser engine, with the CVE-2024-27834 bypass. The payload then swept Safari and third-party app containers for cookies and sent them to a server controlled by the attackers.
Sekoia identified further chains against other outdated software. One targeted iPhones on iOS 18.5 with an exploit kit known as DarkSword, which harvested messages, photos, location data and stored credentials. Another targeted Android phones running affected versions of Chrome and stole cookies, saved logins, browsing history and Wi-Fi passwords.
Most of the victim organisations were in Ukraine, with others in Europe and the United States. None of the chains work against devices running current software. Sekoia said the flaws were all previously patched n-day vulnerabilities, and noted that a user running an up-to-date operating system is safe from these attacks.
What Apple users should do
The CISA deadline applies only to U.S. federal agencies under Binding Operational Directive 26-04. However, CISA encourages every organisation to treat catalog entries as urgent, and the same logic applies to individual users.
Any iPhone, iPad, Mac or Apple Watch updated to the May 2024 releases or later is protected. Devices stuck on older versions, especially models no longer receiving updates, carry the real risk. The campaign succeeded precisely because attackers bet that many devices would never receive the fix.
Apple users can check their software version in Settings and install the latest available update. Updating to the newest supported release closes the flaw. The advice applies equally to users in Malaysia, since the attacks targeted anyone visiting the compromised websites, not one country.
The case also shows why severity scores are a poor guide to real-world danger. A medium-rated flaw from 2024 became a working weapon for a state-sponsored group in 2026 because outdated devices stayed exposed long after the fix arrived.
0