CISA Flags Apple Pointer Authentication Bypass Amid Information-Stealing Attacks

CISA added CVE-2024-27834, an improper authentication vulnerability affecting multiple Apple products, to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The flaw allows an attacker who already has arbitrary read and write capabilities to bypass Pointer Authentication; it is not a standalone initial-access vulnerability. Apple released fixes in May 2024. Federal Civilian Executive Branch agencies must remediate by November 18, 2026, and other organizations should prioritize affected devices for vendor-recommended updates.

The addition follows Sekoia reporting on information-stealing attacks exploiting previously patched Safari and Google Chrome vulnerabilities to collect browser and device data. Sekoia attributed the activity to Russia-linked APT29 with moderate to high confidence and reported malicious JavaScript delivery through compromised legitimate websites, impersonation sites, and a supply-chain attack targeting Plerdy SEO Tracker. The accompanying news report contains an inconsistent CVE identifier in its exploit-chain description, leaving the precise role of CVE-2024-27834 in that campaign unclear. CISA lists its use in ransomware campaigns as unknown.