Active Exploitation of Patched Apple Authentication Flaw (CVE‑2024‑27834) Delivers Info‑Stealing Malware
What It Is — CISA added CVE‑2024‑27834 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The flaw is an improper authentication issue in multiple Apple operating systems (iOS, iPadOS, macOS, watchOS, tvOS) that allows an attacker who can present a crafted request to bypass authentication checks and execute arbitrary code. Exploits observed in the wild have been used to drop information‑stealing malware on compromised devices. The vulnerability carries a CVSS v3.1 base score of 5.5 (medium) and was patched by Apple in a recent security update, but threat actors continue to target unpatched or partially patched installations.
Affected Products — Apple iOS 17, iPadOS 17, macOS 14, watchOS 10, tvOS 10 (and earlier versions that have not applied the latest security update).
Why It Matters for Trust & Control Assurance — The incident underscores the need for strong identity‑and‑access controls and continuous monitoring of authentication events, even for flaws that have been patched.
Recommended Actions
- Verify that the latest Apple security update (addressing CVE‑2024‑27834) is deployed on all managed devices.
- Enforce multi‑factor authentication (MFA) for all privileged and remote access pathways.
- Enable and regularly review authentication and system‑log alerts for anomalous sign‑in attempts or code‑execution events.
- Conduct a rapid audit of your authentication controls and capture evidence of compliance with access‑control objectives.
- Consider deploying endpoint detection and response (EDR) rules that flag the known malware payloads associated with this exploit.
Source: The Hacker News