Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

CISA has added CVE-2024-27834, a medium-severity improper authentication vulnerability affecting multiple Apple operating systems, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw carries a CVSS score of 5.5 and has been reported as actively exploited in the wild. Despite being previously patched by Apple, threat actors are leveraging the vulnerability to deliver information-stealing malware to victims. The addition to the KEV catalog signals that federal agencies and organizations should prioritize patching. The exploitation underscores the risk of delayed patch adoption even for medium-severity vulnerabilities when active exploitation is confirmed.