CISA has added CVE-2024-27834, an improper authentication flaw that lets an attacker bypass Pointer Authentication on several Apple platforms, to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
What Is It
CVE-2024-27834 is an improper authentication vulnerability (CWE-287) affecting Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS. According to NVD, an attacker who already has arbitrary read and write capability may be able to bypass Pointer Authentication. Apple says it fixed the issue with improved checks.
NVD scores it CVSS 3.1 5.5 (MEDIUM), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. That means local attack vector, low complexity, low privileges required, no user interaction, and high integrity impact.
Why It Matters
According to the CISA KEV catalog entry, CISA added this CVE to the catalog on 2026-11-04, which confirms it is being exploited in the wild. CISA's SSVC assessment in the NVD record also lists exploitation as "active", automatable as "no" and technical impact as "partial."
The flaw requires an attacker to already have arbitrary read/write capability. It is therefore a bypass of an exploit mitigation, not a standalone entry point. This suggests it is most likely used as one link in an exploit chain alongside other bugs, though public details of the observed exploitation are limited. Confirmed exploitation also suggests the medium CVSS score may understate the practical risk. The KEV entry lists use in ransomware campaigns as Unknown.
What's Vulnerable
Per NVD, these versions are affected:
- Safari before 17.5
- iOS and iPadOS before 16.7.8 and before 17.5
- macOS Sonoma 14.0 up to (not including) 14.5
- tvOS before 17.5
- watchOS before 10.5
NVD configurations also list:
- WebKitGTK before 2.44.2
- WPE WebKit before 2.44.2
- Fedora 39 and 40
Patch Status
Fixes are available in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. NVD's configuration data marks WebKitGTK and WPE WebKit 2.44.2 as the first unaffected versions.
The CISA KEV entry gives the required action as applying mitigations according to vendor instructions, following BOD 26-04 ("Prioritizing Security Updates Based on Risk") and CISA's Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance. If no mitigations are available, stop using the product. Stakeholders must also evaluate each asset's internet exposure. The federal remediation due date is 2026-11-18.
Sources
- CISA Known Exploited Vulnerabilities Catalog, CVE-2024-27834: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2024-27834
- NVD, CVE-2024-27834: https://nvd.nist.gov/vuln/detail/CVE-2024-27834
- Apple Security Update 120896: https://support.apple.com/en-us/120896
- Apple Security Update 120898: https://support.apple.com/en-us/120898
- Apple Security Update 120901: https://support.apple.com/en-us/120901
- Apple Security Update 120902: https://support.apple.com/en-us/120902
- Apple Security Update 120903: https://support.apple.com/en-us/120903
- Apple Security Update 120905: https://support.apple.com/en-us/120905
- Apple Support HT214101: https://support.apple.com/en-us/HT214101
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements): https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Openwall oss-security: http://www.openwall.com/lists/oss-security/2024/05/21/1
- Fedora package announcement: https://lists.fedoraproject.org/archives/list/[email protected]/message/ADCLQW54XN37VJZNYD3UKCYATJFIMYXG/