CISA Adds Apple Flaw to Exploited Vulnerabilities List
The medium-severity flaw, tracked as CVE-2024-27834, is now on the federal catalog of vulnerabilities known to be actively exploited.
Updated on Nov. 5, 2026 in Cybersecurity
The U.S. Cybersecurity and Infrastructure Security Agency added a medium-severity security flaw affecting multiple Apple operating systems to its Known Exploited Vulnerabilities catalog on Wednesday. Separately, researchers at Sekoia reported that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware.
Why it matters
The catalog listing signals that the flaw is being used in real attacks, not just theoretical risk. Federal agencies are expected to act quickly, and the broader activity shows how previously patched browser bugs can still be turned into working attack chains.
CVE-2024-27834 is an improper authentication flaw that could let an attacker with arbitrary read and write capability bypass Pointer Authentication, and Apple's fixes arrived in iOS and iPadOS 16.7.8 and 17.5 and macOS Sonoma 14.5. The affected population and the extent of real-world exploitation beyond the reported campaign have not been disclosed.
The players
Cybersecurity and Infrastructure Security Agency (CISA)
The U.S. federal agency responsible for coordinating cybersecurity defense and maintaining the Known Exploited Vulnerabilities catalog.
APT29
A Russian state-linked hacking group also known as Cozy Bear and Midnight Blizzard, widely tracked by security researchers for espionage operations.
The details
The flaw was first demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024 and was addressed by Apple in May 2024. Sekoia reported that attackers use compromised legitimate websites, fake sites impersonating popular sites, and a supply chain attack on the Plerdy SEO Tracker, with a zero-click chain combining CVE-2025-43529 and a pointer authentication bypass to run a cookie-stealing payload.
Timeline
March 2024: The vulnerability was demonstrated as a zero-day at Pwn2Own Vancouver.
May 2024: Apple released fixes across multiple operating system versions.
Wednesday, November 4, 2026: CISA added CVE-2024-27834 to its catalog.
November 18, 2026: Recommended patch deadline for federal civilian agencies.
The Tech Race
The listing follows the catalog's established pattern of flagging vulnerabilities once exploitation is confirmed, here applied to a bug first demonstrated at Pwn2Own Vancouver in March 2024. It underscores how quickly disclosed browser and OS flaws can be weaponized by state-linked groups.
Users running affected iOS, iPadOS, or macOS versions should install the fixed releases, including iOS and iPadOS 16.7.8 or 17.5 and macOS Sonoma 14.5. Browser users should also keep Safari and Chrome updated, since previously patched bugs are being chained into attacks.
The takeaway
Keeping operating systems and browsers current is the most direct defense against flaws that attackers are already using. Patching promptly matters even for bugs rated medium severity, because exploitation can follow disclosure quickly.
What happens next
Federal civilian agencies are recommended to apply the necessary patches by November 18, 2026.
Further reading
Track more threats in our Cybersecurity coverage, which tracks how exploited flaws move from disclosure to real attacks.
