CISA Adds CVE-2024-27834 to Its Exploited Vulnerabilities Catalog
On November 4, CISA added CVE-2024-27834, an improper authentication flaw affecting multiple Apple products, to its Known Exploited Vulnerabilities catalog. The addition came more than two years after Apple released a fix in May 2024. What changed was the evidence of exploitation: CISA’s catalog entry reflects that the flaw has been exploited in the wild, according to selected evidence source.
The vulnerability carries a CVSS score of 5.5. That figure describes technical severity, not whether attackers are using a flaw, as Blackpoint Cyber threat intelligence analyst Andi Ursry explained in the report. For teams that sort their patch queues mainly by score, the distinction matters: an older, medium-rated vulnerability can remain relevant when evidence shows it has a place in an active attack.
What the Pointer Authentication Bypass Requires
According to CISA’s description quoted in the report, CVE-2024-27834 could let an attacker with arbitrary read and write capability bypass pointer authentication. That prerequisite is important. The flaw is not described as giving an attacker memory access by itself; it concerns what an attacker may be able to do after gaining the ability to read and alter memory. Pointer authentication is the defense the attacker could then bypass.
The report identifies affected products as Apple iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. An organization’s exposure therefore depends on which affected devices and software it still has, and whether the relevant fix was installed. Sectigo senior fellow Jason Soroko urged teams to identify devices missing Apple’s May 2024 fix and confirm that updates are installed. He also advised assessing whether a device was compromised before it was patched, rather than treating installation of the update as the whole investigation.
Why an Older Apple Flaw Appears in Current Attack Reporting
SC Media reported that exploitation of CVE-2024-27834 was linked to campaigns by Russian nation-state actors such as APT29, also known as Midnight Blizzard, involving watering-hole and zero-click exploit chains. That is a reported link, not a claim that every instance of exploitation followed the same route or involved the same actor.
Soroko also cited Sekoia’s November 4 reporting that attackers paired the Apple flaw with CVE-2025-43529, a high-severity remote code execution vulnerability, to steal cookies. In that account, the pointer authentication bypass matters as part of a chain rather than as a standalone description of initial access. Soroko warned that stolen session cookies can permit account access without a password. The pairing also explains the timing: a flaw Apple patched in 2024 can still matter when it appears alongside vulnerabilities patched in 2025 on devices that have missed updates.
Where Pointer Authentication Fits in the Attack Chain
CVE-2024-27834 is not described as a way to gain access to an Apple device from scratch. According to CISA, an attacker must already have arbitrary memory read and write capability before the flaw can be used to bypass Pointer Authentication. That distinction matters: the bypass weakens a defense at a later point in an attack, when another weakness or technique has already given the attacker substantial control.
SC Media reported that the flaw was actively exploited in the wild and reportedly linked to campaigns involving Russian nation-state actors, including APT29/Midnight Blizzard, that used watering-hole and zero-click exploit chains. Those descriptions should not be read as proof that CVE-2024-27834 alone enables either kind of attack. Its documented role is narrower: it can help an attacker get past Pointer Authentication after the required memory access is in place.
Why a Moderate Score Can Hide a Consequential Role
Jason Soroko of Sectigo pointed to reporting from Sekoia that attackers paired CVE-2024-27834 with CVE-2025-43529, a high-severity remote code execution flaw, to steal cookies. In that account, the Apple bypass matters because it supports a chain with a more serious outcome than its CVSS 5.5 score might suggest on its own. The score describes the flaw’s technical severity; it does not measure the full effect of combining it with another vulnerability.
Cookie theft also shifts the question beyond the device. Soroko warned that stolen session cookies can allow access to accounts without a password. For a business, that means finding an outdated device is only one part of the investigation if theft is suspected. Account activity and affected sessions need attention too. Readers following broader Security coverage will recognize the distinction: repairing the vulnerable software does not, by itself, establish whether an attacker used a session before the repair.
What the Device and Account Records Can Reveal
Apple released a fix in May 2024, yet the reported chain also involved a vulnerability patched in 2025. That gap makes update status especially relevant for Macs, iPhones and iPads that may have missed earlier fixes. Andi Ursry of Blackpoint Cyber recommended using device-management and access records to identify outdated devices, then examining unpatched devices and their associated identities for suspicious behavior, connections to known malicious infrastructure, and unusual access or session activity.
Consider a hypothetical company whose older Mac still accesses a business account. Confirming that the Mac lacks the fix would identify an exposure, not prove compromise. If records also showed unusual session activity, investigators would have a separate reason to examine that account and, where theft was suspected, revoke affected sessions. The same distinction applies when devices are used to reach Cloud services: device patch status and account-session evidence answer different questions about the reported attack path.
Which Apple Devices Need a Closer Look?
The product list in CISA’s notice, as reported by SC Media, spans iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. That breadth does not mean every device running those products remains vulnerable. Apple released a fix in May 2024; the practical question is which devices still lack the relevant update. The report does not provide a device-by-device version matrix, so teams should not infer patch status from a product name alone.
Andi Ursry of Blackpoint Cyber recommends using device-management and access records to find outdated Macs, iPhones, and iPads. Those records serve different purposes: one can show what software a managed device is running, while the other can help identify devices used for business access. If a device is absent from management records, that absence is a visibility gap—not proof that it is patched or compromised. A defensible review starts with devices whose update status can be checked, then flags those whose status cannot yet be confirmed.
Patch Status Is Not the Whole Investigation
Jason Soroko of Sectigo advises confirming that updates are installed and assessing whether devices were compromised before patching. That distinction matters for a device found to be behind: installing an update addresses the missing fix, but it does not answer what happened while the device was exposed. The source does not establish that every unpatched device was attacked, so the investigation should follow available evidence rather than treat an outdated version as an incident by itself.
For devices that remain unpatched, Ursry recommends monitoring device activity and associated identities for suspicious behavior, connections to known malicious infrastructure, and unusual access or session activity. Those checks are particularly relevant where a device has been used to reach business accounts. If cookie theft is suspected, Soroko says teams should examine account activity and revoke affected sessions alongside updating the software. Revoking a session is a response to suspected account exposure, not a substitute for fixing the device.
Make the Decision Specific to Exposure
CISA’s addition establishes evidence of exploitation, but it does not establish that a particular organization was targeted. Darin Fredde of Ridge Security recommends weighing known exploitation alongside exposure, business impact, and the effectiveness of existing controls. For this flaw, that means separating a confirmed-updated device from one that missed the fix, and separating an unpatched device with relevant account activity from one whose activity is still unknown. Each calls for a different check; none should be dismissed solely because the CVSS score is 5.5.
Ursry also points to minimum software versions for business access as a way to prevent outdated devices from falling through the cracks. That is a prospective access decision, while reviewing existing device and account records addresses the current gap. Where records are incomplete, the honest finding is that patch or exposure status remains unverified. The source supports identifying those devices and investigating their activity; it does not support assuming an attack occurred or claiming that a newly applied patch resolves possible session theft.
What the Reporting Does Not Establish
CISA’s addition of CVE-2024-27834 to its Known Exploited Vulnerabilities catalog establishes an important point: there is evidence of exploitation. It does not, by itself, explain how many devices were affected, which organizations were targeted, or whether any particular device in a reader’s environment was compromised. The SC Media report also describes a reported link to Russian nation-state campaigns, including APT29/Midnight Blizzard. That attribution should not be treated as a finding about every instance of exploitation.
The distinction matters for the reported exploit chain, too. SC Media quotes a Sectigo researcher describing Sekoia’s account of attackers pairing this flaw with CVE-2025-43529 to steal cookies. That is a more specific account than the KEV listing alone provides. A reader should not infer that every use of CVE-2024-27834 involved that second vulnerability, produced stolen cookies, or followed the same path. Nor does a missing update prove that a device was attacked. Patch status answers one question; evidence of past activity answers another.
How to Check the Underlying Records
Start with CISA’s KEV entry for CVE-2024-27834. Check the vulnerability identifier and CISA’s description of the pointer authentication bypass rather than relying on a headline or the CVSS score. Then consult Apple’s security documentation for the affected product and software version. SC Media reports that Apple released a fix in May 2024; Apple’s own notices are the appropriate place to confirm how the fix applies to a specific device. A broad product list is not a substitute for matching the version actually installed.
For the claimed attack chain, read Sekoia’s Nov. 4 analysis directly and separate what its researchers observed from what they infer. In particular, check the evidence presented for the pairing with CVE-2025-43529 and for cookie theft. If assessing a particular organization, its device-management and access records can answer a different, narrower question: which devices remained outdated and whether associated accounts showed activity that warrants investigation. Those records cannot automatically establish that the reported campaign reached the organization.
This leaves room for an honest finding of uncertainty. An organization might confirm that a device lacked the fix yet find no evidence in the records it has of suspicious access. It should describe those as separate findings, not collapse them into either “compromised” or “safe.” Conversely, if account activity suggests session theft, an installed update does not resolve what may have happened before it was applied.
FAQ
Does CISA’s KEV listing identify the attackers?
No. The listing concerns known exploitation of CVE-2024-27834. SC Media separately reports a link to campaigns involving Russian nation-state actors; readers should examine the underlying reporting before applying that attribution to a particular incident.
Is the CVSS 5.5 score evidence that exploitation was unlikely?
No. The score describes technical severity, while CISA’s KEV addition reflects evidence of exploitation. The researchers quoted by SC Media caution that the flaw’s role in a chain may matter more than its score suggests.
Can an installed fix rule out earlier compromise?
No. SC Media’s sources recommend checking devices that missed the fix and assessing whether they were compromised before patching. Where cookie theft is suspected, they also recommend investigating account activity and revoking affected sessions.
