CVE-2024-27855 is a security vulnerability affecting Apple iOS and iPadOS devices where a shortcut could access sensitive data through certain actions without requiring user consent. Apple addressed this issue by implementing improved validation checks to prevent unauthorized use of sensitive information by shortcuts. The vulnerability is rated high severity (CVSS 8.8) due to its potential to compromise confidentiality, integrity, and availability. Official patches are available in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, and iPadOS 17.5. The vulnerability affects devices including iPhone 8 and later, iPad 5th generation and later, and various iPad Pro models as detailed in the advisory. No active exploitation has been reported.

If exploited, this vulnerability could allow a shortcut to access sensitive data without prompting the user, potentially leading to unauthorized disclosure or misuse of personal information. The CVSS vector indicates network attack vector with low attack complexity, no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability consequences. However, there are no known exploits in the wild currently.

Apple has released official patches that address this vulnerability in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, and iPadOS 17.5. Users and administrators should update affected devices to these versions or later to mitigate the risk. No additional mitigation actions are required beyond applying the official updates.