A fix shipped in May 2024. By November 2026, that same fix was still the difference between safe and compromised. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after reports that a Russian state-sponsored group was using it against unpatched devices. This analysis examines what happened, where controls broke down, and what your team can do about it.
What Happened
CVE-2024-27834 is an improper authentication flaw (CVSS 5.5) that lets an attacker bypass Pointer Authentication with arbitrary read and write capability. Apple fixed it in May 2024 with improved checks across iOS 16.7.8, iOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
Sekoia reported that threat actors, possibly linked to Russia, exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware that harvests browser and device data. The activity was attributed to APT29, also known as Cozy Bear and Midnight Blizzard, with "moderate to high confidence."
Attackers used three initial access paths: compromised legitimate websites, fake sites masquerading as popular ones, and a supply chain attack against Plerdy SEO Tracker. Each served malicious JavaScript that profiled the visitor's device, triggered the vulnerability, and deployed an information-stealing payload. The exploit chain paired a WebKit remote code execution flaw with the pointer authentication bypass to run a JavaScript payload built for browser cookie theft.
Timeline
- March 2024: CVE-2024-27834 is demonstrated as a zero-day at Pwn2Own Vancouver.
- May 2024: Apple patches the flaw across its operating systems and Safari.
- Later period: Sekoia reports exploitation of previously patched Safari and Chrome vulnerabilities, attributed to APT29.
- November 5, 2026: CISA adds CVE-2024-27834 to the KEV catalog.
- November 18, 2026: Deadline for Federal Civilian Executive Branch agencies to apply the patches.
The critical gap is between a fix being available and a KEV deadline being set. A patch was available for a long time before any regulator treated this as an urgent, mandated item.
Which Controls Failed or Were Missing
The reporting describes the attack path, not specific victim failures. It highlights control categories that this attack chain defeats when they're weak.
Patch Coverage on Uncontrolled Endpoints. Exploitation works against devices that haven't applied the fix Apple released in May 2024. Browsers and mobile operating systems are typical gaps, especially on personal, contractor, and unmanaged devices.
Severity-Driven Prioritization. A CVSS score of 5.5 is medium. Teams that prioritize remediation by score alone may defer medium findings. This one became a KEV entry. Score alone doesn't indicate whether a flaw is being exploited.
Third-Party Script Governance. The Plerdy SEO Tracker supply chain attack turned a trusted marketing script into a delivery mechanism. Any site that loads third-party JavaScript inherits that vendor's compromise.
Session and Credential Protection. The payload targets browser cookies. Stolen session tokens can let an attacker bypass password and some multifactor controls because the session is already authenticated.
Threat Intelligence Intake. Exploitation of an older, patched flaw is easy to miss if your intelligence feeds only trigger on new zero-days.
What the Relevant Standards Require
CIS Controls v8.1 addresses this directly. Control 7 (Continuous Vulnerability Management) calls for a documented process, automated operating system and application patching, and remediation based on risk rather than a single score. Control 2 (Inventory and Control of Software Assets) and Control 1 (Inventory and Control of Enterprise Assets) are prerequisites: you can't patch what you haven't inventoried, including mobile and end-user devices.
NIST SP 800-53 covers similar ground in SI-2 (Flaw Remediation), which requires identifying, reporting, and correcting system flaws and testing updates before installation, and RA-5 (Vulnerability Monitoring and Scanning). SR-3 and SR-5 address supply chain controls and acquisition strategies, relevant to the compromised third-party script.
CISA Binding Operational Directive requirements model the KEV deadline. Under the directive, FCEB agencies must remediate KEV entries by the stated due date. Private organizations aren't bound by it, but the KEV catalog is a free, authoritative signal of what's being exploited now.
NIST Cybersecurity Framework (CSF) 2.0 places this under the Identify function (risk assessment, including vulnerability identification and prioritization) and Protect (platform security, including timely maintenance). Its supply chain risk management category speaks to the Plerdy vector.
PCI DSS is worth checking if you run payment pages. Requirement 6 covers identifying and addressing vulnerabilities, and its client-side script requirements (6.4.3 and 11.6.1 in v4.0) address the kind of third-party JavaScript risk shown here.
Lessons and Action Items for Your Team
Treat KEV as a Priority Override. Ingest the catalog automatically. Any KEV entry that matches your asset inventory moves to the front of the queue regardless of CVSS. Set your own internal due date; don't wait for a regulatory one.
Close the Unmanaged Device Gap. Decide how you'll verify OS and browser versions on personal and contractor devices. A Bring Your Own Device (BYOD) Policy should set minimum OS and browser versions and make access conditional on them. Conditional access that checks device posture before granting a session is the enforcement mechanism.
Inventory Third-Party Scripts. List every external JavaScript source loaded on your sites and applications. Apply content security policy, subresource integrity where feasible, and a review process for new tags. Marketing and analytics scripts need the same vendor scrutiny as any other supplier.
Shorten Session Lifetimes and Bind Sessions. Cookie theft is only valuable if stolen tokens stay valid. Reduce token lifetimes for sensitive applications, use device-bound sessions where your identity provider supports them, and monitor for session reuse from new locations.
Widen Your Threat Intelligence Aperture. Subscribe to reporting that tracks exploitation of old vulnerabilities, not just new ones. When a state-linked actor like APT29 is attributed, map its reported initial access methods to your own exposure.
Measure Patch Latency, Not Just Patch Counts. Track Mean Time to Remediate for browsers and mobile operating systems separately from servers. Report the oldest unpatched exploited vulnerability to leadership as a Key Risk Indicator (KRI).
Rehearse the Cookie-Theft Scenario. Run a Tabletop Exercise where session tokens are stolen from a patched-late device. Test whether your Incident Response Plan covers forced session revocation and credential reset at scale, consistent with NIST SP 800-61.
A medium-severity score and a long-ago patch date don't make a flaw safe. The lesson from this case is that exploitation timelines are set by attackers, and your remediation process has to follow evidence of exploitation, not the calendar.
