CISA Adds Patched Apple Vulnerability to Known Exploited Vulnerabilities Catalog Amid APT29 Campaign Warnings

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion follows mounting intelligence reports regarding active exploitation in the wild, prompting federal agencies to secure their systems against emerging threats tied to state-sponsored espionage operations.

The vulnerability in question is designated as CVE-2024-27834, bearing a Common Vulnerability Scoring System (CVSS) score of 5.5. It involves an improper authentication issue that could theoretically allow a malicious actor equipped with arbitrary read and write capabilities to bypass critical Pointer Authentication safeguards. Pointer Authentication Codes (PACs) are a fundamental hardware-backed security feature designed to protect memory integrity on modern processors by cryptographically signing pointers, making it significantly harder for attackers to hijack control flow during code execution.

This specific flaw was originally brought to public light and addressed by Apple in May 2024. At that time, the Cupertino-based tech giant rolled out improved authorization checks across a wide array of its software ecosystem, encompassing updates for iOS and iPadOS versions 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. Before Apple issued its patches, the vulnerability had been successfully demonstrated as a zero-day exploit during the high-profile Pwn2Own Vancouver hacking contest held in March 2024, where security researchers showcased how it could be leveraged under specific laboratory conditions.

The decision by CISA to incorporate CVE-2024-27834 into the KEV catalog closely follows a comprehensive threat intelligence report published by cybersecurity firm Sekoia. The report detailed how sophisticated threat actors, assessed with moderate to high confidence to be linked to the Russian state-sponsored hacking group known as APT29—also recognized by industry monikers such as Cozy Bear and Midnight Blizzard—have been actively exploiting previously patched vulnerabilities residing in both Apple’s Safari browser and Google Chrome. According to the findings, these advanced persistent threat operators have leveraged the flaws to deliver complex malware payloads designed explicitly to harvest sensitive browser and device data from unsuspecting visitors.

APT29 is historically affiliated with Russia’s Foreign Intelligence Service and has earned a reputation for conducting highly targeted, long-term cyber espionage campaigns against government entities, diplomatic missions, think tanks, and critical infrastructure organizations worldwide. In this latest observed campaign, the attackers utilized multiple distinct initial access pathways to ensnare victims. These pathways included the compromise of legitimate, trusted websites, the deployment of deceptive lookalike sites masquerading as popular web destinations, and a targeted supply chain attack aimed directly at the Plerdy SEO Tracker service.

Through these initial access vectors, the malicious operators injected malicious JavaScript code designed to profile the incoming visitor’s device. Upon successfully identifying a vulnerable browser or operating system environment, the scripts would trigger the underlying vulnerabilities, ultimately deploying information-stealing payloads. Security researchers analyzing the attack chains noted that the sophisticated zero-click exploit mechanics often combine multiple components, such as remote code execution flaws in WebKit alongside pointer authentication bypasses like CVE-2024-27834, culminating in the execution of scripts tailored for targeted browser cookie theft and credential harvesting.

Following the formal addition of CVE-2024-27834 to the KEV catalog, the cybersecurity agency has issued binding operational guidance. Federal Civilian Executive Branch (FCEB) agencies are now strongly recommended and legally mandated under Binding Operational Directive frameworks to apply all necessary software patches and updates by November 18, 2026, to mitigate potential exposure to state-backed cyber espionage operations exploiting these legacy weaknesses.