CISA added CVE-2024-27834, an improper authentication vulnerability affecting multiple Apple products, to the KEV catalog after reports of active exploitation. The alert is dated November 4, 2026. A catalog record for the entry shows a federal remediation due date of November 18, 2026.
What the bug is, and what it isn't
The flaw could let an attacker who already has arbitrary read and write capability on a device bypass Pointer Authentication (PAC), a hardware-based protection against certain memory-corruption attacks. Apple's advisory credits Manfred Paul, working with Trend Micro's Zero Day Initiative, and describes the fix as "improved checks."
The prerequisite matters. Mallory's write-up stresses that this is not a standalone initial-access vulnerability. The attacker needs a separate foothold first. PAC is an exploit-hardening layer: it makes it harder to turn a memory bug into reliable code execution. Bypassing PAC is one link in a chain.
The severity score is modest. The Hacker News gives CVSS 5.5. That is a reminder that CVSS alone is a poor guide to what attackers are really using.
Who is exploiting it
CISA's alert and the catalog entry give no attacker, victim or campaign details. The catalog entry lists known ransomware campaign use as "Unknown." That is not evidence for or against ransomware involvement.
Press coverage adds some context. The Hacker News says the KEV addition follows a Sekoia report that threat actors possibly linked to Russia exploited previously patched Safari and Chrome vulnerabilities to deliver malware that harvests browser and device data. The activity was attributed to APT29 (also known as Cozy Bear and Midnight Blizzard) with "moderate to high confidence." Sekoia says the exploit chain uses a PAC bypass built on CVE-2024-27834 to forge the valid pointers needed for arbitrary code execution.
That attribution comes from Sekoia, as relayed by the press. CISA's alert does not make it.
Two other points from the coverage:
- The flaw was originally demonstrated as a zero-day at the Pwn2Own Vancouver competition in March 2024.
- Rescana says neither Apple nor CISA has published indicators of compromise for this CVE. If you suspect a compromise, investigate the whole device, not just this CVE.
Affected products and fixes
CISA's description names iOS, iPadOS, macOS, Safari, tvOS and watchOS. Apple addressed it in updates covering those platforms. Apple's Safari 17.5 advisory shows the release date as May 13, 2024. That advisory lists the WebKit fix for macOS Monterey and macOS Ventura.
Version thresholds differ by platform. NVD data, as summarized in the research brief, lists these fixed releases:
- Safari 17.5
- iOS and iPadOS 16.7.8 and 17.5
- macOS 14.5
- tvOS 17.5
- watchOS 10.5
I could not load the NVD page directly. Confirm the exact fixed build for each device against Apple's platform-specific advisory. Don't rely on one version number for everything.
What administrators should do
- Inventory Apple devices. Include iPhones, iPads, Macs, Apple TVs and Apple Watches, whether managed by an MDM or sitting on guest and BYOD networks.
- Check the OS or Safari version against Apple's advisories. Treat anything at or below the NVD thresholds as a priority.
- Flag devices that can't update. Hardware that has aged out of Apple's support may have no fixed release. CISA's required action says to discontinue use of a product if mitigations are unavailable.
- Review exposure. CISA's catalog entry tells stakeholders to evaluate each asset's internet exposure and follow BOD 26-04 patching guidelines.
- Check for prior compromise on devices that went unpatched. The entry points to CISA's "Forensics Triage Requirements." CISA says BOD 26-04 sets expectations for checking whether a system was compromised before it was patched.
- For individuals: turn on automatic updates. Use unique passwords and multifactor authentication, because the reported malware targets browser data.
BOD 26-04 and who the deadline binds
BOD 26-04 is titled "Prioritizing Security Updates Based on Risk." According to CISA, it requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk KEV vulnerabilities. It focuses on publicly exposed assets that give total control once exploited. It lets agencies defer lower-risk items.
The directive applies only to those agencies. The November 18 date does not legally bind private companies. CISA nonetheless encourages all organizations to adopt risk-based vulnerability management and prioritize KEV entries. I could not open the directive text itself, so I'm relying on CISA's alert summary.
Why Windows-focused teams should care
This is an Apple bug, but few enterprises run a single platform. Mixed fleets of Windows PCs, Macs and iPhones are normal, often managed through the same tooling. KEV is a vendor-neutral list that many teams use to rank patches.
The exploitation reportedly goes after browsers, so the same kind of chain can target any platform. The Sekoia activity reportedly involved Chrome flaws as well as this Safari one. Old, fixed browser bugs stay useful to attackers wherever patching lags.
Bottom line
- A 2024 WebKit PAC bypass is now on KEV, with a federal due date of November 18, 2026.
- It is a post-foothold exploitation aid, not a standalone remote-entry bug.
- Fixes have shipped since May 2024. The risk sits with unpatched and unsupported Apple devices.
- Verify versions per platform, retire devices that can't be updated, and triage anything that stayed unpatched.