CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog, tied to Apple operating systems and Safari, and gave it a CVSS score of 5.5, signaling high priority for mitigation.

The vulnerability was added after reports of active exploitation, reinforcing its status as a high-priority risk for federal and broader networks.

The attack chain uses three initial access methods—compromised legitimate sites, fake sites mimicking popular sites, and a supply-chain attack on Plerdy SEO Tracker—that deliver malicious JavaScript to trigger the vulnerability.

Advisories note that this vulnerability is a common attack vector with significant risk to federal networks.

CVE-2024-27834 allows an attacker with arbitrary read and write access to bypass Pointer Authentication, weakening memory protections and enabling further exploitation.

Beyond bypassing Pointer Authentication, the vulnerability weakens defenses against memory-corruption attacks and can enable additional exploitation when combined with other flaws.

The CVE enables improper authentication that paves the way for data harvesting from browsers and devices when combined with an exploit chain.

FCEB agencies are required to remediate identified KEV vulnerabilities under BOD 22-01, with a remediation due date of November 18, 2026.

CISA, Sekoia, and Binding Operational Directive guidance are cited as sources for the advisory.

Sekoia reports APT29-linked activity using compromised and malicious websites and a supply-chain attack to deliver JavaScript that exploits Safari and Chrome to deploy information-stealing malware.

Security researchers from Sekoia say threat actors tied to Russia (APT29/Cozy Bear) exploited patched Safari and Chrome vulnerabilities to deploy a data-harvesting malware.

Private organizations are urged to review the KEV Catalog and remediate vulnerabilities across their infrastructure.