93← Home

CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability

Headline from Apple — Multiple Products · compiled from 6 sources

Our analysis · checked against 14 sources

CISA lists 2024 Apple pointer-authentication flaw as exploited; federal fix due Nov 18

On November 4, 2026, CISA added CVE-2024-27834, an Apple flaw patched in May 2024, to its exploited-vulnerabilities catalog after attackers chained it with a WebKit bug against older iPhones. NVD rates it Medium (5.5), not Critical; federal civilian agencies must remediate by November 18, 2026.

The framing"Critical CVEs" does fit a flaw CISA confirms is actively exploited and has given agencies a November 18 deadline to fix. But NVD and CISA-ADP score it Medium, 5.5, and it works only after another bug has already given the attacker read and write access.

What the headline leaves out

  • It cannot be used alone: the attacker must already have read/write access from another bug, here a WebKit flaw delivered by malicious websites.
  • Apple's fix has existed since May 13, 2024, about two and a half years before the listing.
  • Its official severity is Medium (5.5), not Critical.
  • No count of affected or still-unpatched devices has been published.

What the coverage got wrong

  • The Hacker News write-up, which internally names CVE-2025-43529 for both the WebKit RCE and the PAC bypass: “CVE-2025-43529 is the pointer authentication (PAC) bypass in the iOS exploit chain”. This is an internal inconsistency in The Hacker News' own article; Sekoia, BleepingComputer and Cybersecurity News agree the PAC bypass in the iOS 16.7 chain is CVE-2024-27834, chained with CVE-2025-43529 as the WebKit flaw.cybersecuritynews.com

What happens next

Federal civilian agencies must remediate by November 18, 2026 under CISA's BOD 26-04. Sekoia researchers say it is unclear whether the attackers targeted visitors to specific sites or sought as many unpatched devices as possible. Sekoia also warns that state actors reusing commercial exploit kits "lowers the cost" of advanced mobile exploitation. Watch for further campaign reports and whether agencies meet the deadline.

Possible knock-on effects
  • Reuse of commercial-surveillance exploit kits such as DarkSword could let more state-backed groups exploit unpatched older iPhones, which may matter most to users who have not updated since 2024. (named expert: Sekoia researchers, who say kit reuse lowers the cost and technical threshold of mobile exploitation. Watch for: New reports of other groups using the same CVE-2024-27834 chain)
  • The KEV deadline may push federal agencies to update or retire Apple devices still on unpatched versions, which could matter to agency IT teams with older iPhones. (mechanism: BOD 26-04 requires federal civilian agencies to remediate KEV entries by the set due date. Watch for: CISA or agency statements on compliance after November 18, 2026)

Sources: CISA Adds One Known Exploited Vulnerability to Catalog (primary), CVE-2024-27834 severity record (primary), NVD CVSS vector for CVE-2024-27834 (primary), VulDB entry 264082 (primary), Rescana: CVE-2024-27834 pointer auth bypass, Mallory: exploitation preconditions and BOD deadline, Apple advisory text (VulnRadar issue), The Hacker News: APT29-linked hackers hijack websites, The Hacker News: Hackers exploit patched Apple flaw, Cybersecurity News: Russian APT29 hackers, BleepingComputer: Hackers use n-day exploits in zero-click attacks on iOS, Android devices, Infosecurity Magazine: APT29 watering holes target iPhones, Intruder CVE monitor, Help Net Security: APT29 watering hole

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

CISA says it has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog "based on evidence of active exploitation"[1]

According to Rescana, CISA added CVE-2024-27834, a WebKit flaw in Apple platforms, to the KEV catalog on 4 November 2026 and gave federal agencies until 18 November 2026 to fix it[2].The Hacker News describes the flaw as an improper authentication bug (CVSS score: 5.5) that could let an attacker who already has arbitrary read and write capability bypass Pointer Authentication[3]. The outlet reports that Apple fixed it in May 2024 in iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5[3]. It adds that the bug was first shown as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024[3].The Hacker News says the KEV listing follows a Sekoia report that threat actors possibly linked to Russia exploited previously patched flaws in Safari and Google Chrome[3]. BleepingComputer reports that Sekoia attributes the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard)[4].According to BleepingComputer, Sekoia said the attackers used CVE-2025-43529 and CVE-2024-27834 against iOS 16.7[4], and the payload targets cookies stored in Safari[4].Infosecurity Magazine reports that the campaign delivered exploit chains to visitors of legitimate websites, with payloads built to steal cookies, device data and Wi-Fi passwords without any user interaction[5].Gulf News reports that the researchers said devices running the latest available security updates were protected against the exploit chains they identified[6].

Listen to the songCritical CVEs (1 of 3) — November 05, 2026

Sources

  1. [1]CISA Adds One Known Exploited Vulnerability to Catalog | CISA
  2. [2]Apple CVE-2024-27834: Pointer Authentication Bypass Added to CISA KEV — What to Check – Rescana
  3. [3]Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
  4. [4]Hackers use n-day exploits in zero-click attacks on iOS, Android devices
  5. [5]APT29 Watering Holes Target Unpatched iPhones and Android Devices - Infosecurity Magazine
  6. [6]Hackers target iPhone, Android users through compromised websites

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability | 93