The Cybersecurity and Infrastructure Security Agency (CISA) on Nov. 4 added an improper authentication vulnerability affecting multiple Apple products to its known exploited vulnerabilities (KEV) list.
The CVSS 5.5 bug from two years ago — CVE-2024-27834 — was actively exploited in the wild and reportedly linked to campaigns by Russian nation-state actors such as APT29/Midnight Blizzard using watering-hole and zero-click exploit chains.
The bug affects the following products: Apple iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. According to CISA, the flaw could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Jason Soroko, senior fellow at Sectigo, said teams with affected Apple devices should act on CISA’s warning. Soroko said CISA added this flaw to its catalog because it found evidence of active exploitation.
A 5.5 CVSS severity score should not outweigh that evidence when setting patch priorities: Soroko said this flaw lets an attacker who can already read and alter memory bypass a defense. He said Sekoia reported in a Nov. 4 blog that attackers paired the Apple flaw with a high-severity remote code execution flaw (CVE-2025-43529) to steal cookies, so its role in that chained attack matters more than its score alone.
Apple released a fix in May 2024, so Soroko said teams should identify devices still missing it and confirm updates are installed. They should also assess whether those devices were compromised before patching.
“Stolen session cookies can let attackers access accounts without the password,” said Soroko. “Where theft is suspected, teams should investigate account activity and revoke affected sessions as well as update the software.”
Andi Ursry, threat intelligence analyst at Blackpoint Cyber, added that the CVSS score describes a vulnerability’s technical severity, but it does not tell us whether attackers have exploited it. Ursry said a medium-rated vulnerability can be a critical part of an attack when it lets a threat actor bypass a security measure that would otherwise prevent it.
The Apple vulnerability lets an attacker who already has memory read and write capabilities bypass Pointer Authentication, which could offer a path to further exploitation. Ursry said when vulnerabilities are only prioritized if they are rated high or critical, there’s a risk that the vulnerabilities supporting portions of an attack could remain unpatched.
“Confirmed exploitation, even on a medium-severity vulnerability should trigger a new prioritization decision for an organization,” said Ursry.
This Apple vulnerability was patched in 2024 and chained with vulnerabilities patched in 2025, so Ursry said organizations should identify devices that have fallen through the cracks for updates. Organizations should use device management and access records to identify outdated Macs, iPhones, and iPads. Enforcing minimum software versions for business access can help prevent these gaps. For devices that are not patched, Ursry said organizations should monitor device activity and associated identities for suspicious behaviors, connections to known malicious infrastructure and unusual access or session activity.
Darin Fredde, senior director and offensive security evangelist at Ridge Security, added that while a CVSS score of 5.5 might not raise eyebrows, evidence of active exploitation certainly should. Fredde said CVSS is an important measure of vulnerability severity, but it doesn't tell the entire story of organizational risk: attackers can combine seemingly modest weaknesses into much more consequential attack paths.
So, should security teams listen to CISA?
“Absolutely,” said Fredde. “Known exploitation is evidence that should influence prioritization, alongside exposure, business impact, and the effectiveness of existing controls. We should continue patching based on risk, but also validate whether our defenses can withstand the attack paths adversaries are using. A vulnerability's severity helps us understand its potential impact. Evidence of exploitation reminds us that the threat is no longer theoretical.”
