Who is not affected by CVE-2024-27834?

Not affected if: fully-patched-devices.

HIGH5.5CVSS · nvd@nist.gov

EXPLOITED
IN THE WILDCISA KEV

APPLE MULTIPLE PRODUCTS · CVE-2024-27834 · Vendor

Apple iOS, macOS, Safari: pointer authentication bypass exploited in the wild

FIX → 17.5 · 14.5 · 10.5 · 2.44.2

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 have an improper authentication flaw that lets an attacker with arbitrary read and write capability bypass pointer authentication. CISA lists it as known exploited, and a linked report ties n-day exploits to APT29 watering-hole attacks on mobile devices.

Full story ↓Less ↑

first public May 14, 2024 · on CISA KEV · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

Any Apple device running iOS, iPadOS, macOS, Safari, tvOS or watchOS 10.5 or earlier is in scope. The sources describe an attacker who already has arbitrary read and write capability, so the exposure is highest for people targeted by watering-hole or mobile exploit campaigns. Organisations with Apple fleets should treat it as urgent.

Apple Multiple Products
apple safari< 17.5fixed in 17.5
apple ipados< 17.5fixed in 17.5
apple iphone os< 17.5fixed in 17.5
apple macos>= 14.0, < 14.5fixed in 14.5
apple tvos< 17.5fixed in 17.5
apple watchos< 10.5fixed in 10.5
webkitgtk< 2.44.2fixed in 2.44.2
wpewebkit wpe webkit< 2.44.2fixed in 2.44.2

Exploited: Yes, on CISA KEV
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

CISA KEVKnown Exploited Vulnerabilities: the US government’s list of bugs confirmed as attacked in the wild

Added: Nov 4, 2026
Patch due: Nov 18, 2026
Ransomware use: Unknown

What CISA requires: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.moreless

How it unfolded

3 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 2026sekoia.com Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
Nov 4, 202620:56 UTCCISA KEV CVE-2024-27834
Nov 4, 202620:59 UTCNVD CVE-2024-27834

What the sources say, verbatim

721 characters

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.