CISA Flags Actively Exploited Apple Flaw: Check Your Devices Are Updated

The US Cybersecurity and Infrastructure Security Agency (CISA) has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The flaw is CVE-2024-27834, an improper authentication vulnerability affecting multiple Apple products. CISA says it has evidence the vulnerability is being actively exploited.

CISA notes that this type of vulnerability is a frequent attack vector for malicious cyber actors. The agency's binding directive, BOD 26-04, requires US federal agencies to prioritise rapid fixes for high-risk KEV vulnerabilities on publicly exposed systems, and to check whether attackers compromised a system before the patch was applied. The directive applies only to federal agencies.

CISA encourages all organisations, not just government bodies, to adopt risk-based vulnerability management and to prioritise fixing the vulnerabilities listed in the KEV Catalog. The catalog is a useful guide for any business deciding which updates to tackle first.