CVE-2024-27834
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- support.apple.com/en-us/120896Vendor AdvisoryRelease Notes
- support.apple.com/en-us/120898Vendor AdvisoryRelease Notes
- support.apple.com/en-us/120901Vendor AdvisoryRelease Notes
- support.apple.com/en-us/120902Vendor AdvisoryRelease Notes
- support.apple.com/en-us/120903Vendor AdvisoryRelease Notes
- support.apple.com/en-us/120905Vendor AdvisoryRelease Notes
- seclists.org/fulldisclosure/2024/May/10Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2024/May/12Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2024/May/16Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2024/May/17Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2024/May/9Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2024/05/21/1Mailing ListThird Party Advisory
- Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with
The Hacker News · 23h ago - CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security U
CISA Alerts · 1d ago
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- 12 days left (2026-11-18)
- CVSS
- 5.5 MEDIUM
- EPSS (30-day exploit probability)
- 1.4% · top 27% of all CVEs
- Weakness
- NVD-CWE-noinfo
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.