A 5.5 medium-severity vulnerability just landed in CISA's Known Exploited Vulnerabilities catalog, and the reason is a lesson every security team should internalize. Severity scores measure isolated flaws. Attackers measure chains.
CVE-2024-27834 is an improper authentication flaw in multiple Apple operating systems. Apple patched it in May 2024. CISA added it to the KEV catalog on Wednesday, following reporting from Sekoia that tied active exploitation to APT29, the Russia-linked group also tracked as Cozy Bear and Midnight Blizzard.
The severity score says 5.5. The impact, when chained, says something else entirely.
What the Flaw Actually Does
CVE-2024-27834 allows an attacker who already has arbitrary read and write capability to bypass Pointer Authentication.
Pointer Authentication is one of Apple's core memory-safety defenses. It signs pointers so that an attacker who corrupts memory cannot simply redirect execution wherever they like. Bypassing it removes a layer of protection that modern exploit chains otherwise have to work around.
On its own, the flaw is not much. It requires an existing memory corruption primitive. That is why Apple rated it 5.5.
But that is not how it was used.
The Pwn2Own Origin
The vulnerability was demonstrated as a zero-day at Pwn2Own Vancouver in March 2024. Contest researchers showed the bypass working in a live environment months before Apple shipped a fix.
That timeline matters. A flaw demonstrated publicly at a hacking contest is a flaw that has been studied, documented, and in some cases copied. The window between demonstration and weaponization is not always measured in years.
Apple addressed it with improved checks in the following releases.
|
Platform |
Fixed Version |
|
iOS / iPadOS |
16.7.8, 17.5 |
|
macOS Sonoma |
14.5 |
|
tvOS |
17.5 |
|
watchOS |
10.5 |
|
Safari |
17.5 |
Those patches shipped in May 2024. That is roughly eighteen months of available patching before this KEV addition.
How APT29 Chained It
Sekoia's reporting on the Poisoned Source campaign describes an exploit chain that combines two flaws.
The first is CVE-2025-43529, a remote code execution flaw in WebKit. The second is the pointer authentication bypass, CVE-2024-27834. Together they allow a JavaScript payload to break out of the browser sandbox and execute code designed for browser cookie theft.
Sekoia attributed the activity to APT29 with moderate to high confidence.
The delivery mechanism has three paths.
- Compromised legitimate websites with injected malicious JavaScript
- Lookalike domains impersonating high-profile destinations in the U.S., Ukraine, Czech Republic, and Bulgaria
- Supply chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics service, between August 27 and September 3, 2026
The injected script profiles the visitor's browser and device, then serves a platform-specific exploit chain. On iOS, that chain ends in the DarkSword exploit kit, which we covered in detail previously.
Why a Medium Score Matters
Here is the part worth understanding, because it explains why CISA took action on a 5.5.
Severity scores are calculated per vulnerability, assuming isolated exploitation. That is the right model for triage and prioritization across thousands of CVEs. It is the wrong model for understanding what an exploit kit actually does.
A chain does not care about individual scores. It cares about whether the pieces fit. A 5.5 PAC bypass plus an 8.x WebKit RCE is not a medium-severity incident. It is a full device compromise.
CISA's KEV addition reflects exactly that reasoning. The catalog exists to flag vulnerabilities that are being exploited in the wild, regardless of what the isolated score suggests. A patch that is sitting unapplied because someone deprioritized it at 5.5 is now a confirmed target.
The Federal Deadline
Federal Civilian Executive Branch agencies must apply the necessary patches by November 18, 2026.
That is the standard KEV timeline. It applies directly to FCEB agencies, but private organizations should treat it as a useful signal. CISA has confirmed active exploitation. The patch has existed since May 2024. There is no reason to wait.
What Defenders Should Do
- Patch to the fixed versions. iOS and iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, Safari 17.5. If you are on a newer release, you likely have the fix already, but verify.
- Check managed Apple device compliance. MDM platforms can report OS versions across your fleet. Run that report and identify anything below the thresholds.
- Audit browser version compliance. Safari is called out separately because the flaw affects it directly. Any device running an older Safari build is in scope.
- Reassess deprioritized patches. If your team skipped this one because of the 5.5 score, that decision needs a second look, given confirmed exploitation.
- Watch for Poisoned Source indicators. Plerdy script injection, the lookalike domains Sekoia listed, and traffic to ad.starx-net[.]com:8881 are all established signals.
- Block the DarkSword exfiltration endpoint at the network edge if you can.
The Larger Lesson
A vulnerability score is a starting point for triage, not a verdict on risk. CVE-2024-27834 sat at 5.5 for over a year. It is now confirmed as part of a nation-state exploit chain targeting browsers and mobile devices.
The gap between "we'll get to it" and "it's in the KEV catalog" is often measured in months of unnecessary exposure.
FAQ
What is CVE-2024-27834?
It is an improper authentication vulnerability in multiple Apple operating systems that allows an attacker with arbitrary read and write capability to bypass Pointer Authentication.
Why is CISA adding a 5.5 severity flaw to the KEV catalog?
Because CISA's KEV catalog tracks vulnerabilities that are being exploited in the wild, regardless of isolated severity scores. Sekoia's research tied this flaw to active exploitation by APT29 as part of an exploit chain.
Which Apple versions are affected?
iOS and iPadOS before 16.7.8 and 17.5, macOS Sonoma before 14.5, tvOS before 17.5, watchOS before 10.5, and Safari before 17.5.
How was the flaw exploited?
APT29 chained it with CVE-2025-43529, a WebKit remote code execution flaw, to deliver a JavaScript payload that steals browser cookies and, in some variants, full device data.
What is the delivery mechanism?
Sekoia identified three pathways: compromised legitimate websites, lookalike domains, and a supply chain compromise of Plerdy SEO Tracker between August 27 and September 3, 2026.
Is this the same campaign that targeted iPhones and Androids?
Yes. This is the Poisoned Source campaign, which uses the DarkSword exploit kit on iOS and AndroSnitch on Android.
What is the federal deadline?
FCEB agencies must apply the necessary patches by November 18, 2026.
What should I do if I cannot patch immediately?
Restrict browsing of untrusted sites on unpatched devices, block the known exfiltration endpoint, and prioritize the update. Pointer Authentication bypass is not something you can mitigate through configuration.
