A security flaw that Apple addressed well over a year ago is still being turned against unpatched machines, according to a U.S. government advisory published this week — a reminder that shipping a fix and deploying one are two very different milestones.
CISA adds CVE-2024-27834 to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed CVE-2024-27834 in its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, 4 November, following reports of active exploitation in the wild, The Hacker News reported on 5 November.
The bug carries a CVSS base score of 5.5 — a "medium" rating — and is described as an improper authentication issue affecting multiple Apple operating systems. Under CISA's Binding Operational Directive 22-01, federal civilian agencies are required to remediate KEV-listed vulnerabilities within three weeks of listing; while the directive binds government agencies only, its deadlines have become a widely used benchmark for private-sector patch programmes.
The specific Apple OS builds covered by the fix should be confirmed against Apple's own security bulletin before remediation is signed off, since coverage spans more than one operating system family.
Severity scores versus real-world risk
CVE-2024-27834 illustrates a persistent weakness in how many organisations triage their patch queues. A 5.5 score will typically sit in the middle of a backlog, routinely outranked by higher-severity issues that nobody is actually attacking. KEV inclusion inverts that logic: confirmed exploitation is a stronger signal of risk than a theoretical severity calculation, and vulnerabilities with credible evidence of use in attacks should be treated as priority one regardless of where they land on the CVSS scale.
The second gap is temporal. Apple's patch exists; the exposure lies in the window between a vendor fix becoming available and that fix reaching every machine in a fleet. For organisations running large, heterogeneous Mac estates, that window can stay open for months — which appears to be exactly what has happened here.
Why the payload matters
According to The Hacker News, the exploitation is associated with delivery of information-stealing malware. No specific infostealer family has been named in reports so far, and no attribution should be inferred beyond what has been reported. Regardless of which strain is in play, credential-, session-token- and browser-data-harvesting payloads are a natural fit for this class of flaw, and that makes it attractive to financially motivated operators who have little reason to care about a medium severity rating.
What fleet administrators should do
- Verify update coverage across all managed macOS and Apple OS endpoints, confirming that the builds carrying the CVE-2024-27834 fix are actually installed, not merely offered by the vendor.
- Consult Apple's security bulletin directly for exact version and build numbers before declaring compliance.
- Review indicators of compromise and telemetry for signs of credential or session-token theft, and force re-authentication where suspicious activity is suspected.
- Harden delivery channels, ensuring MDM profiles, update rings and application allowlists are enforcing the patched state rather than deferring it.
- Track KEV additions as a standing feed in patch-priority workflows rather than treating CVSS scores as the sole triage input.
Mac fleet administrators everywhere — including those managing deployments in Hong Kong — face the same underlying problem: a fix only counts once it is deployed. Public advisories from bodies such as HKCERT and platform-vendor bulletins remain useful cross-checks for verifying that local estates reflect the latest available fixes.
根據本週發表的一份美國政府通告，一個 Apple 早在一年多前已修補的安全漏洞，至今仍被用來攻擊未修補的電腦——這正好說明「推出修補程式」與「部署修補程式」是兩個截然不同的里程碑。
CISA 將 CVE-2024-27834 列入 KEV 目錄
美國網絡安全和基礎設施安全局（CISA）於 11 月 4 日星期三將 CVE-2024-27834 列入其「已知被利用漏洞」（KEV）目錄，此前有報告指該漏洞已在野外遭主動利用，《The Hacker News》於 11 月 5 日報道。
該漏洞的 CVSS 基礎評分為 5.5——屬「中等」級別——被描述為影響多個 Apple 操作系統的身份驗證不當問題。根據 CISA 的《具約束力行動指令 22-01》，聯邦民用機構須在漏洞被列入清單後三週內完成修補；雖然該指令僅約束政府機構，但其時限已成為私營機構修補計劃廣泛採用的參考基準。
在簽署修補完成之前，應先對照 Apple 自身的安全通告，確認修補所涵蓋的特定 Apple OS 版本，因為涉及的範圍跨越多於一個操作系統系列。
嚴重性評分與實際風險的落差
CVE-2024-27834 凸顯了許多機構在排列修補優先次序時的一個長期弱點。5.5 分通常會排在待辦清單的中間位置，經常被嚴重性更高、但實際上並無人攻擊的問題排在前面。列入 KEV 則顛覆了這個邏輯：已獲證實的利用活動，比理論上的嚴重性計算更能反映風險；凡有確鑿證據顯示在攻擊中被使用的漏洞，不論其在 CVSS 評級中處於何處，都應列為第一優先處理。
第二個落差在於時間。Apple 的修補程式已經存在；風險在於廠商修補程式推出，到該修補到達機隊中每一台電腦之間的時間窗口。對於擁有龐大且混合型 Mac 資產的機構而言，這個窗口可能持續數月——而這次情況似乎正是如此。
為何惡意載荷值得關注
據《The Hacker News》報道，此次利用與投放資訊竊取惡意軟件有關。目前的報道尚未指明具體的 infostealer 家族，不應作出超出報道內容的歸因推斷。不論涉及哪一種類型，收集憑證、session token 及瀏覽器數據的惡意載荷，與這類漏洞可說是天然契合，這也令其成為以牟利為目的的攻擊者眼中的目標——他們根本不會在意「中等嚴重性」的評級。
機隊管理員應採取的措施
- 核實更新覆蓋範圍：檢查所有受管理的 macOS 及 Apple OS 端點，確認搭載 CVE-2024-27834 修補程式的版本確實已安裝，而不只是廠商提供了更新。
- 直接查閱 Apple 安全通告：在宣布合規之前，核對確切的版本及版本號。
- 審查入侵指標（IOC）及遙測數據：留意憑證或 session token 被竊的跡象，如懷疑有可疑活動，應強制重新進行身份驗證。
- 加固分發渠道：確保 MDM 設定描述檔、更新環（update ring）及應用程式白名單均在執行已修補狀態，而非一再延後部署。
- 將 KEV 新增項目作為固定資訊來源納入修補優先次序流程，而非將 CVSS 評分視為唯一的篩選依據。
各地的 Mac 機隊管理員——包括負責香港部署的人員——都面對同一個根本問題：修補程式只有在部署之後才算數。來自 HKCERT 等機構的公開通告，以及平台廠商的安全通告，仍是核實本地資產是否已反映最新可用修補的有效參考。