The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog to include a medium-severity Apple security flaw after active exploitation was observed in the wild. Federal Civilian Executive Branch agencies have been ordered to apply the necessary software patches by November 18, 2026. The vulnerability, tracked as CVE-2024-27834, has been targeted by threat actors to deliver information-stealing malware to vulnerable devices through malicious and compromised websites.
The underlying issue involves an improper authentication flaw with a CVSS score of 5.5, which allows attackers to bypass Pointer Authentication. Apple originally addressed this vulnerability in May 2024 across a wide array of software products, including iOS and iPadOS versions 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. Security researchers noted that the vulnerability is part of a complex exploit chain combining a WebKit remote code execution flaw with the pointer authentication bypass.
Technical reports indicate that the malicious activity involves harvesting browser and device data, specifically targeting browser cookies. Attack delivery mechanisms identified by researchers include compromised websites, fake websites, and a supply chain attack involving Plerdy SEO Tracker, which was used to serve malicious JavaScript to site visitors. These methods enable threat actors to compromise user environments and extract sensitive information without immediate detection from standard security controls.
Security researchers at Sekoia reported the exploitation activity, which has been attributed with moderate to high confidence to the state-sponsored threat group known as APT29, also referred to as Cozy Bear or Midnight Blizzard. While Apple issued patches for the affected systems in May 2024, recent threat intelligence findings prompted the official catalog addition and mandated remediation timelines for government agencies to mitigate ongoing risks associated with these supply chain and web-based delivery vectors.
The active exploitation of this legacy vulnerability underscores the persistent danger posed by state-sponsored actors targeting web and browser components. Organisations and individual users who fail to apply software updates promptly remain exposed to sophisticated info-stealing campaigns that leverage browser data harvesting. Although the flaw requires chaining with other vulnerabilities like WebKit execution issues, successful exploitation can compromise sensitive enterprise and personal data stored within web sessions.
Federal agencies must ensure compliance with the mandated remediation deadline of November 18, 2026, by applying all relevant Apple software patches. General users operating older Apple devices or software versions should verify that their systems are fully updated to the supported builds released in May 2024. Maintaining rigorous patch management practices across all device ecosystems remains a fundamental best practice for defending against advanced persistent threats and opportunistic info-stealer campaigns.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
