CISA has added an Apple authentication-bypass flaw, a 2024 bug that can get around pointer authentication, to its Known Exploited Vulnerabilities catalog, the list of bugs that attackers are known to use. The catalog entry names the issue CVE-2024-27834 and calls it an improper authentication weakness across multiple Apple products.
The bug is not new, and fixed versions already exist. Apple's Safari 17.5 notes cover the issue, and NVD lists fixed releases for Safari, iOS, iPadOS, macOS, tvOS and watchOS. For businesses that manage Apple devices, the listing is a prompt to confirm those updates are in place.
Key facts
- CISA added CVE-2024-27834 to the KEV catalog on 2026-11-04, with a due date of 2026-11-18.
- CISA's entry says an attacker who can already read and write memory at will could get around pointer authentication.
- The affected products are Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS.
- NVD says the fix shipped in Safari 17.5, iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.
- NVD scores the flaw 5.5, rated MEDIUM, under CVSS v3.1, and the KEV entry lists ransomware use as unknown.
Background
NVD shows the CVE was first published on 2024-05-14. According to Apple, Safari 17.5 came out on May 13, 2024, and its security notes describe the same problem that CISA now lists.
Apple's security notes describe the same risk: someone who can already read from and write to memory at will might get past Pointer Authentication. In other words, CISA's description frames the attacker as someone who already has that read and write ability.
Apple credits the find to Manfred Paul, working with Trend Micro's Zero Day Initiative. Apple also says it does not disclose, discuss or confirm security issues until it has investigated and patches are ready.
The catalog listing is newer than the fix. CISA added the entry on 2026-11-04, and CISA's alert says this type of flaw is a common route in for malicious cyber actors.
What it means for you
The deadline in the catalog applies to federal agencies. CISA's alert says BOD 26-04 covers only Federal Civilian Executive Branch agencies, but the agency urges all organizations to make fixing KEV flaws a priority.
For a business, the main question is whether every Apple device and browser is on a fixed version. The KEV entry lists six product lines, so the check covers more than computers and browsers.
NVD lists two fixed lines for iOS and iPadOS, 16.7.8 and 17.5, so devices on either line have a fixed release to install. The same NVD record names macOS Sonoma 14.5 as the fixed Mac release, along with tvOS 17.5 and watchOS 10.5.
Remote devices can be easy to miss. CISA advises businesses to have IT turn on automatic updates where possible and to remind workers, especially remote staff, to do the same.
Older hardware raises a separate issue. CISA recommends replacing hardware or software that has reached end of life, because it no longer receives security updates.
Keeping track of devices and update status takes steady work. A managed IT service can handle routine updates and follow-up across a mixed fleet. A cybersecurity program can help rank which fixes need attention first. When old devices need to be swapped out, IT procurement support can help plan and source replacements. For more on planning around fixed deadlines, see this guide to risk-based patch deadlines.
Practical steps
- List every Apple device and every copy of Safari in use, including devices used by remote staff.
- Check each one against the fixed releases that NVD lists: Safari 17.5, iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.
- Update any device running an older release, and confirm the update finished.
- Flag any device that cannot install a fixed release, and weigh replacing it.
- Turn on automatic updates where possible, as CISA advises, and remind staff to keep updates on.
- Plan to replace devices or software that have reached end of life, since CISA says such products no longer get security updates.
- Use 2026-11-18, the federal due date, as a target for finishing the review.
A short guide on planning for end of support covers how to approach aging systems that no longer get fixes.
What happens next
Federal civilian agencies must address the flaw by 2026-11-18. Other organizations are not bound by that date, but CISA encourages them to give KEV flaws priority.
The KEV entry lists known ransomware use as unknown. Security teams can keep an eye on the catalog entry for any updates.
