Anyone with an iPhone, iPad, Mac, Apple TV or Apple Watch that has missed updates since 2024 should install the latest software now. The US Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple KEV vulnerability, CVE-2024-27834, to its Known Exploited Vulnerabilities catalogue, meaning it has evidence the flaw has been used in real attacks.
The bug itself is not new. Apple fixed it on 13 May 2024 in updates including Safari 17.5 and macOS Sonoma 14.5. The news is CISA’s listing on 4 November 2026, which gives US federal agencies until 18 November to make sure they are protected.
In brief
- CISA has added Apple’s CVE-2024-27834, a WebKit flaw, to its list of vulnerabilities exploited in attacks.
- Apple fixed the bug in May 2024, so devices that are up to date are already protected.
- CISA does not say who used it or how, and lists ransomware use as “Unknown”.
What CISA listed
CISA’s entry describes the bug like this: “Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.” It is classed as CWE-287, improper authentication.
The entry was added to catalogue version 2026.11.04 with a due date of 18 November 2026 for federal civilian agencies. CISA lists known ransomware use as “Unknown”. It does not name an attacker, a target or a date of first exploitation, and TSN makes no claim about who is behind any attacks.
What Apple fixed in 2024
Apple’s notes place the flaw in WebKit, the engine behind Safari and every web browser on iPhone and iPad. Apple says that “a malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication”. It credits the find to “Manfred Paul (@_manfp) working with Trend Micro’s Zero Day Initiative”.
The fixes shipped on 13 May 2024 in Safari 17.5, macOS Sonoma 14.5 and other Apple updates released the same day, including iOS 16.7.8 and iPadOS 16.7.8 for older iPhones and iPads.
Pointer authentication is a hardware security feature in Apple’s chips. It signs certain memory addresses so that an attacker who has corrupted memory cannot easily redirect the program. A bypass does not break into a device alone. As the wording shows, the attacker must already be able to read and write memory, so this kind of flaw is usually one link in a chain of exploits.
Why an old bug matters now
A two-year-old bug appearing on CISA’s list may look odd, but it is common. CISA adds a flaw when it has reliable evidence of exploitation, and that evidence can come long after the patch. The listing is a signal that someone has found the bug useful, most likely against devices that were never updated.
That is the main risk for ordinary users. Phones and computers that stopped receiving updates, or whose owners turned updates off, can stay exposed for years. Because pointer authentication bypasses are typically chained with other bugs, their use often points to targeted attacks rather than mass campaigns, but CISA has not said either way, and readers should not assume a particular attacker.
TSN has covered how quickly Apple bugs can be combined, for example in Calif’s untethered iOS jailbreak demonstration at Hexacon, and in Apple’s recent patch for an exploited CoreGraphics flaw on older iPhones. Old, already-patched bugs remain a common way in across the industry too, as with the Palo Alto GlobalProtect flaw that ransomware gangs exploited months after its fix.
What to do
- On iPhone and iPad, go to Settings, then General, then Software Update, and install the latest version.
- On a Mac, open System Settings, then General, then Software Update.
- Turn on automatic updates where available.
- If a device no longer receives updates, stop using it for sensitive browsing, banking or work accounts.
Organisations should check their device inventories for Apple hardware still running software older than the May 2024 releases, and treat any that cannot be updated as a risk to replace.
Sources
- CISA: Known Exploited Vulnerabilities catalogue, entry for CVE-2024-27834 (added 4 November 2026)
- Apple: About the security content of Safari 17.5 (13 May 2024)
- Apple: About the security content of macOS Sonoma 14.5 (13 May 2024)
- Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8 (13 May 2024)
Related stories
- Calif Demos an Untethered iOS 27.0.1 Jailbreak on iPhone 18 Pro at Hexacon
- Apple Patches Exploited CoreGraphics Flaw on Older iPhones and iPads
- Ransomware Gangs Exploit Palo Alto GlobalProtect Flaw Patched in May
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
