CVE-2024-27834: CISA Flags Old Apple WebKit Flaw as Exploited

CISA has added CVE-2024-27834, a WebKit Pointer Authentication bypass that Apple quietly patched back in May 2024, to its Known Exploited Vulnerabilities (KEV) catalog. The agency's own listing, published November 4, 2026, confirms the two-year-old flaw is now being actively exploited in the wild and gives federal agencies until November 18, 2026 to remediate it. If your iPhone, iPad, Mac, Apple TV or Apple Watch isn't already running the May 2024 security updates or later, this is the week to stop putting it off.

What happened: an old WebKit bug just landed on CISA's exploited list

On November 4, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, under the entry name "Apple Multiple Products Improper Authentication Vulnerability." CISA's own record sets a federal civilian remediation deadline of November 18, 2026, and instructs agencies to apply Apple's mitigations in line with its Binding Operational Directive 26-04 patching guidance.

What makes this entry unusual is the age of the bug. CVE-2024-27834 isn't new — it's a vulnerability Apple fixed more than two years ago, in the May 13, 2024 round of security updates. KEV additions are reserved for vulnerabilities CISA has confirmed are being actively exploited, not just theoretically exploitable, so the listing is itself the news: something, or someone, is now using a bypass technique against devices that were never updated past early 2024 software.

This is the second Apple-related KEV addition Pandromeda has covered in recent months, after CVE-2026-86950, a separate and unrelated zero-day that was exploited and patched this year. CVE-2024-27834 is a different vulnerability entirely, discovered and fixed years earlier, and the two should not be confused.

What CVE-2024-27834 actually is

Per Apple's own security-content pages and the National Vulnerability Database entry for CVE-2024-27834, the issue sits in WebKit, the browser engine that powers Safari and every app that renders web content on Apple platforms. NVD describes it as: "The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication."

Pointer Authentication (PAC) is a hardware-backed security feature in Apple's ARM-based chips that cryptographically signs pointers — memory addresses a program uses to reference other pieces of code or data — so that an attacker who has somehow gained the ability to read and write arbitrary memory still cannot easily hijack a program's control flow. It's one of the core defenses that makes modern memory-corruption exploits on iOS and macOS dramatically harder to build than they used to be.

CVE-2024-27834 matters because it undermines that specific defense. By itself, a Pointer Authentication bypass doesn't let an attacker break into a device — it requires that the attacker already has "arbitrary read and write capability," meaning some other, separate vulnerability (often a WebKit memory-corruption bug triggered by malicious web content) to get that far in the first place. What a PAC bypass does is remove one of the next layers of defense, making it realistic to chain a memory-corruption bug into full code execution. That's a common pattern in real-world WebKit exploit chains: one bug for the initial memory corruption, a second to defeat mitigations like PAC, and sometimes a third for a sandbox escape.

NVD's CVSS 3.1 base score for the flaw is 5.5, rated Medium, with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — reflecting that it requires local access and some privilege, needs no user interaction, and primarily affects integrity rather than confidentiality or availability when exploited on its own. Apple credited the discovery to security researcher Manfred Paul (@_manfp), working with Trend Micro's Zero Day Initiative, according to its advisory text.

Why a two-year-old Medium-severity bug is suddenly a KEV entry

A CVSS score of 5.5 is nowhere near the 9s and 10s normally associated with "patch immediately" headlines, and the fix has been publicly available since May 2024. So why does it warrant a KEV listing now? Because KEV eligibility isn't about severity scores — it's about confirmed, observed exploitation. CISA only adds a CVE to the catalog once it has evidence that threat actors are using it against real targets, regardless of how old the patch is or how modest the CVSS number looks on paper.

CISA's own KEV entry for CVE-2024-27834 does not name a specific threat actor or campaign; it lists the required action, the due date, and marks "known ransomware campaign use" as unknown. Some security researchers, however, have separately reported activity consistent with exploitation of this flaw as part of a broader "n-day" exploitation campaign — using already-patched vulnerabilities against devices that were never updated — and a few reports have tied related watering-hole activity to Russia-linked threat actors, including APT29. That specific actor attribution is not stated in CISA's KEV entry itself, is sourced to secondary security research rather than confirmed by CISA or Apple, and should be treated as unconfirmed. What is confirmed, directly from CISA's authoritative catalog, is that this vulnerability is being actively exploited today, in November 2026, against devices that remain on pre-May-2024 software.

The underlying dynamic is a familiar one in mobile and browser security: attackers maintain libraries of "n-day" exploits for vulnerabilities that vendors have already fixed, betting that a meaningful slice of the install base hasn't updated. A WebKit Pointer Authentication bypass is a particularly useful building block for that kind of toolkit, since it can be paired with newer memory-corruption bugs to keep exploit chains working even as Apple patches the initial-access bug each time.

Affected products and the versions that fix it

CVE-2024-27834 touches every major Apple platform that ships WebKit. Apple's own security-content advisories — including the entries for Safari 17.5, iOS 17.5 and iPadOS 17.5, and macOS Sonoma 14.5, indexed on Apple's security updates page — list the following fixed versions, all released on May 13, 2024:

If a device has installed any security or OS update released after May 13, 2024 — which includes every subsequent iOS, iPadOS, macOS, tvOS and watchOS release since — it already contains this fix. The risk is concentrated in devices that have gone more than two years without an update: older iPhones and iPads left on outdated software, Macs that have deferred updates, and set-top boxes or watches that rarely get attention from their owners.

The practical advice: check your version, update now

Because this is now a confirmed, actively exploited vulnerability rather than a theoretical one, the calculus around patching has changed even though the fix itself is more than two years old. Practical steps:

• iPhone/iPad: Go to Settings > General > Software Update and confirm the device is on iOS/iPadOS 17.5 or later (or 16.7.8 or later for devices that can't update past iOS 16).
• Mac: Go to System Settings > General > Software Update and confirm macOS Sonoma 14.5 or a later macOS version is installed.
• Apple TV: Go to Settings > System > Software Updates and confirm tvOS 17.5 or later.
• Apple Watch: Open the Watch app on a paired iPhone, go to General > Software Update, and confirm watchOS 10.5 or later.
• Anyone on third-party browsers that embed WebKit on iOS: updating the OS is what matters, since WebKit itself ships as part of the operating system on Apple's mobile platforms.

For most consumer devices in 2026, this is already a non-issue — automatic updates have long since moved past May 2024 software. The exposure is concentrated in enterprise fleets with delayed patch cycles, kiosk or embedded Apple hardware, and personal devices that have simply been neglected. It's a similar story to how organizations track monthly fixes through processes like Patch Tuesday on the Windows side: a KEV addition is CISA's way of saying a specific, dated patch just became urgent again, no matter how routine it looked when it first shipped.

What the KEV catalog is, and why the deadline only binds federal agencies

CISA's Known Exploited Vulnerabilities catalog is a running list of CVEs the agency has confirmed are being exploited in real-world attacks, maintained under Binding Operational Directive 22-01 and its successors. Each entry carries a "required action" and a "due date" that are legally binding on U.S. federal civilian executive branch agencies, which must remediate or mitigate the listed flaw by that date or document why they cannot. For CVE-2024-27834, that required action is to apply Apple's existing fixes — there's no new patch to wait for — in line with the newer BOD 26-04 risk-based prioritization guidance, which also asks agencies to weigh each asset's internet exposure rather than treating every KEV entry identically.

Private companies, state and local governments, and individual device owners are under no legal obligation tied to that November 18 date. In practice, though, security teams across the industry treat a new KEV addition as a strong, independently verified signal to prioritize patching, precisely because CISA only adds a CVE once it has evidence of active exploitation rather than acting on severity scores or vendor advisories alone. A Medium CVSS score sitting on the KEV list is a more urgent real-world signal than a Critical score that has never been observed in attacks.

Why the KEV catalog keeps resurfacing old Apple bugs

This isn't the first time an older vulnerability has reappeared on CISA's exploited list once evidence of real-world abuse surfaces, and it won't be the last. The KEV catalog exists specifically to flag the gap between "a patch is available" and "everyone has installed it," and mobile platforms are a recurring source of these entries because device refresh and update cycles vary so widely across the installed base. The same pattern shows up outside the Apple ecosystem too — CISA recently added a networking-gear flaw, SonicWall's CVE-2026-19868 SSL VPN MFA bypass, under the same active-exploitation logic, even though that case involved a much newer vulnerability.

For WebKit specifically, Pointer Authentication bypasses are a known category attackers return to, because ARM-based Apple silicon leans heavily on PAC as a core exploit mitigation. Removing or weakening that single defense doesn't grant access on its own, but it keeps older exploit chains viable for a device population that never fully migrates off vulnerable software — which is exactly the dynamic CISA's KEV entry appears to be responding to.

What happens next

Federal civilian agencies now have until November 18, 2026 to apply the fix under Binding Operational Directive 26-04; private organizations and consumers face no such deadline, but CISA's standard guidance is that any KEV entry should be treated as high priority for patching regardless of sector. Expect Apple to stay silent on specific attack details, as it typically does, and expect any further clarity on who is actually exploiting this bug to come from independent security research rather than from CISA or Apple directly. Pandromeda will update this piece if CISA, Apple, or additional named research firms publish confirmed attribution.

In the meantime, the actionable takeaway doesn't require waiting on attribution: confirm every Apple device you're responsible for is running May 2024 security updates or newer, and treat "it's an old bug" as irrelevant once a vulnerability is on the KEV list. That status is reserved for flaws CISA has verified are being used against real targets today.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage