Apple CVE-2024-27834 pointer authentication bypass exploited, added to CISA KEV

CISA added Apple CVE-2024-27834, a pointer authentication bypass affecting Apple operating systems and Safari, to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, according to The Hacker News. Apple fixed the flaw in May 2024, so devices that have been updated since then are not exposed. Federal civilian agencies must apply mitigations by November 18, 2026, and every other organisation should treat that date as a useful benchmark.

We are covering this now because new reporting links the flaw to active exploitation, which prompted the KEV addition on November 4, 2026.

What happened

CVE-2024-27834 is an improper authentication flaw (CWE-287). NVD describes it as an issue where an attacker who already has arbitrary read and write capability in a process may be able to bypass Pointer Authentication, a hardware-backed protection that makes memory-corruption exploits harder to run. The NVD record scores it CVSS 5.5, medium.

The Hacker News reports that the KEV addition follows a Sekoia report on a campaign using previously patched Safari and Google Chrome vulnerabilities to deliver malware that harvests browser and device data. Sekoia attributes the activity to APT29 (also tracked as Cozy Bear and Midnight Blizzard) with moderate to high confidence, according to that coverage. Attribution is the researchers’ assessment, not a confirmed finding.

Per the same reporting, the attacks used three initial access routes:

• compromised legitimate websites;
• fake sites imitating popular websites;
• a supply chain attack against Plerdy SEO Tracker.

Each route serves malicious JavaScript that profiles the visitor’s device and then deploys an information stealer. The reported goal is browser cookie theft.

Am I affected?

You are affected if you run an Apple or WebKit-based product older than the fixed releases listed by NVD:

• Safari before 17.5
• iOS and iPadOS before 17.5 (iOS and iPadOS 16.7.8 carry the fix for the older 16.x branch)
• macOS Sonoma 14.x before 14.5
• tvOS before 17.5
• watchOS before 10.5
• WebKitGTK and WPE WebKit before 2.44.2

NVD also lists Fedora 39 and 40 as affected. Apple has not published additional version detail beyond these releases in the data we cite, and CISA lists the KEV product only as “Multiple Products”.

Technical details

The NVD vector is local (AV:L) with low privileges and no user interaction, which fits a bug used as one step in a chain after another flaw gives memory read and write. The press reporting, in contrast, describes a zero-click chain delivered through web content. Those descriptions are not identical, and we have not seen a primary source that reconciles them. The practical reading is that this CVE is a component of a chain, not a standalone remote bug.

The Hacker News reports that the vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024. CISA’s KEV entry lists known ransomware campaign use as unknown.

Why this matters

Analysis, not new facts. A medium CVSS score understates the risk here. KEV status means exploitation has been observed, and the reported delivery methods, including a compromised third-party script, mean users can be exposed simply by browsing to a trusted site. The target is cookies and browser data, so the realistic damage is session hijacking and account takeover, not device destruction. Unpatched, unmanaged or long-lived devices, such as old iPads, shared Macs and media or kiosk hardware, are the likeliest gaps.

Detection and hunting ideas

No indicators of compromise are available to us, so we are not listing any. Defenders can still do the following:

• Inventory Apple endpoints by OS and Safari version and flag anything below the fixed releases above.
• Check web logs and tag managers for Plerdy SEO Tracker and review whether any script from that vendor changed unexpectedly.
• Look for unusual sign-ins or session reuse from new locations after users visited unfamiliar sites.

What to do

1. Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to the fixed versions above or later. Prefer current releases over the minimum.
2. Update WebKitGTK or WPE WebKit to 2.44.2 or later, and apply Fedora updates where relevant.
3. Because the flaw is in KEV, patch exposed devices within hours to days, and meet the November 18, 2026 CISA deadline if you are a federal civilian agency.
4. If you use Plerdy SEO Tracker on your sites, review it and invalidate sessions for users who may have been exposed.
5. Follow CISA’s required action in the KEV entry, including its forensics triage guidance, for devices you cannot patch, or stop using them.

Related coverage

• WordPress Core RCE flaw CVE-2026-119977 added to CISA KEV
• Linux kernel CVE-2026-46300 added to CISA KEV, exploited
• Adobe Commerce and Magento CVE-2026-48356 added to CISA KEV

Sources

• NVD: CVE-2024-27834
• CISA Known Exploited Vulnerabilities catalog: CVE-2024-27834
• The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware