Skip to content
securitytabs

Updated

CISA says attackers are exploiting an older, already patched Apple flaw

The US cyber agency says criminals are using a flaw in Apple's Safari browser and operating systems that Apple has already fixed. Anyone with Apple devices that are not up to date should install current updates.

Exploited flaw in Apple Safari and operating systems
Exploited flaw in Apple Safari and operating systems

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

CISA added CVE-2024-27834, an improper authentication flaw in multiple Apple products, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 4, citing evidence of active exploitation. The National Vulnerability Database rates it 5.5 on the CVSS severity scale. [1][2]

The Hacker News reports the flaw is already patched and describes it as medium severity; its headline links the exploitation to delivery of information-stealing malware, a claim attributed there to CISA. [3]

Fixes and deadlines

Apple has published security advisories for the affected products, which are linked from the CVE record. CISA set a federal due date of November 18 for civilian agencies to apply the fixes under its Binding Operational Directive 26-04. [1]

The sources reviewed do not say who is exploiting the flaw, how many devices are affected, or which attacks are involved. CISA lists known ransomware use as unknown. [1][2]

Timeline

  1. CISA's listing was described as following reports of active exploitation. [3]

  2. CISA set a federal due date of November 18 for applying fixes. [1]

  3. CISA added CVE-2024-27834 to its KEV catalogue. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your staff use Apple laptops, phones or the Safari browser, an out-of-date device may be exposed to a flaw CISA says is being exploited. [1]

What to do

  1. Turn on automatic updates for Apple devices and install pending updates. [3]
  2. Ask your IT provider to confirm that company Apple devices have current updates. [1]

Mid-size company

A small IT or security team

What to know

Apple has already fixed the flaw, so the risk sits with devices that have not been updated. CISA gave federal agencies until November 18. [1][3]

What to do

  1. Check device management reports for Apple systems missing the fixed updates listed in Apple's advisories. [1]
  2. Bring Apple updates forward in the patch schedule rather than waiting for the normal cycle. [3]

Large enterprise

A security operations team

What to know

CISA's KEV listing is based on evidence of active exploitation; no indicators or attribution are given in the sources reviewed. [1][2]

What to do

  1. Inventory Apple endpoints and compare their versions with Apple's advisories for this flaw. [1]
  2. Track Apple's and CISA's updates for any indicators of compromise. [1]

Sources

  1. [1]CISA Advisories · Nov 4, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext
  2. [2]Security Affairs · Nov 5, 08:55 UTC
    U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalogcontext
  3. [3]The Hacker News · Nov 5, 05:17 UTC
    Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Sayscontext