Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple flaw, tracked as CVE-2024-27834, to its Known Exploited Vulnerabilities (KEV) catalog. This critical security vulnerability affects Apple's operating systems and Safari browsers, allowing attackers to bypass Pointer Authentication protections. With a severity score of 5.5, this vulnerability poses significant risks to federal enterprises and private organizations. Organizations are urged to address this vulnerability by November 18, 2026, and prioritize patching and vulnerability management to minimize the risk of attack.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities (KEV) catalog with a critical security vulnerability score of 5.5. The vulnerability affects Apple's operating systems and Safari browsers, allowing an attacker to bypass Pointer Authentication, a hardware-based security mechanism. Exploiting the vulnerability could weaken an important security barrier and make further exploitation of the device easier. Apple has addressed the vulnerability through improved security checks in various software updates. CISA orders federal agencies to fix the flaw by November 18, 2026, and recommends private organizations review the catalog and address the vulnerabilities. Organizations must prioritize patching and vulnerability management to minimize the risk of attack and protect their networks against malicious actors.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added an Apple flaw, tracked as CVE-2024-27834, to its Known Exploited Vulnerabilities (KEV) catalog. This addition comes with a critical security vulnerability score of 5.5, indicating that it poses significant risks to the federal enterprise and other organizations that rely on Apple's operating systems and Safari browsers.
The vulnerability, CVE-2024-27834, is a security vulnerability that affects Apple's operating systems and Safari browsers. It could allow an attacker who already has arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC), a hardware-based security mechanism designed to protect memory addresses and prevent certain types of memory-corruption attacks. Pointer Authentication is a security feature implemented in Apple processors that adds cryptographic signatures to pointers, helping ensure that memory addresses have not been maliciously modified.
An attacker who gains the ability to read and write arbitrary memory could potentially exploit CVE-2024-27834 to circumvent these protections. This could weaken an important security barrier and make further exploitation of the device easier. The impact of this vulnerability is severe, as it could allow attackers to bypass Pointer Authentication protections, weakening defenses against memory-corruption attacks, and potentially facilitating further exploitation when combined with other vulnerabilities.
Apple addressed the vulnerability through improved security checks in Safari 17.5, iOS 16.7.8, and iOS 17.5, iPadOS 16.7.8, and iPadOS 17.5, macOS Sonoma 14.5, and tvOS 17.5, and watchOS 10.5. Cybersecurity firm Sekoia reports on attacks attributed with moderate to high confidence to Russia-linked cyber espionage group APT29, which used compromised websites, fake websites, and a supply-chain compromise of Plerdy SEO Tracker to deliver malicious JavaScript that targeted Safari and Chrome vulnerabilities to bypass security protections and deploy information-stealing malware capable of collecting browser cookies and device data.
The Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, requires federal agencies to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by November 18, 2026. This warning highlights the importance of keeping software up-to-date and the need for organizations to prioritize patching and vulnerability management.
The U.S. CISA's addition of this Apple flaw to its Known Exploited Vulnerabilities catalog serves as a reminder to organizations to prioritize cybersecurity and take immediate action to address identified vulnerabilities. By doing so, they can minimize the risk of attack and protect their networks against malicious actors.
Related Information:
https://www.ethicalhackingnews.com/articles/The-US-Cybersecurity-and-Infrastructure-Security-Agency-Adds-Apple-Flaw-to-its-Known-Exploited-Vulnerabilities-Catalog-ehn.shtml
https://securityaffairs.com/202464/hacking/u-s-cisa-adds-apple-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2024-27834
https://www.cvedetails.com/cve/CVE-2024-27834/
Published: Thu Nov 5 05:42:27 2026 by llama3.2 3B Q4_K_M
