NVD CVSS 3.1: 5.5 (Medium) | CVE: CVE-2024-27834 | CISA KEV: listed 4 Nov 2026 (due 18 Nov) | Fixed: 13 May 2024
On 4 November 2026 CISA added CVE-2024-27834, a WebKit flaw in Apple platforms, to its Known Exploited Vulnerabilities (KEV) catalog, with a federal remediation due date of 18 November 2026. That listing is why we rate this High. The facts also call for calm: Apple fixed the issue on 13 May 2024, the CVSS score is 5.5, and the flaw helps an attacker only after they already have arbitrary read and write capability. CISA marks known ransomware campaign use as Unknown and forensic triage as No. Devices running current Apple software are already protected.
Technical Information
Apple describes the issue as one where "an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication" and says it "was addressed with improved checks" (WebKit Bugzilla 272750). Pointer Authentication is a hardware-backed defense on Apple silicon that makes memory-corruption exploits harder to turn into code execution. This bug weakens that defense. It is not an entry point by itself, so it is most relevant as one link in a chain of exploits.
NVD scores it 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). CISA's KEV entry classifies it as CWE-287 Improper Authentication. NVD's CISA SSVC data rates exploitation as active, automatable as no, and technical impact as partial. Neither Apple nor CISA has published exploitation details, and we do not speculate about them here. The researcher credited for the finding is Manfred Paul (@_manfp), working with Trend Micro's Zero Day Initiative.
Affected Product Versions
Fixed in (per Apple security-content pages for Safari 17.5, iOS/iPadOS 16.7.8, iOS/iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5, and per NVD):
- Safari 17.5 (macOS Monterey and Ventura)
- iOS 17.5 and iPadOS 17.5; iOS 16.7.8 and iPadOS 16.7.8
- macOS Sonoma 14.5
- tvOS 17.5
- watchOS 10.5
Anything earlier than these versions is affected. Later releases include the fix.
Workaround and Mitigation
- Update Apple devices and Safari to the fixed versions or later. For most managed fleets this happened in 2024.
- Use MDM to find stragglers, such as devices that are stuck on old OS versions, unsupported hardware, or kiosk and shared devices.
- Enforce minimum OS versions for corporate access.
- Apple has published no workaround. Patching is the fix.
Indicators of Compromise
Apple and CISA have not published any IOCs for CVE-2024-27834. We list none rather than invent them. If you see suspicious activity on unpatched Apple devices, investigate the device as a whole, not this CVE alone.
What to do with this vendor today (TPRM)
The risk here is a supplier whose staff handle your data on old, unmanaged iPhones or Macs. KEV status means attackers are using this flaw in chains. Today:
- Ask Apple-heavy suppliers, such as agencies, field-service teams, and BYOD-heavy vendors, to confirm that they enforce a minimum OS of iOS/iPadOS 17.5 (or 16.7.8), macOS 14.5, or later for devices that touch your data.
- Ask how they detect and block out-of-date devices: MDM compliance, conditional access, or both.
- Record a deadline that matches CISA's 18 November 2026 date, and follow up with suppliers who don't answer.
Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.
Need help working through Apple-fleet suppliers exposed to CVE-2024-27834? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.11.04): CVE-2024-27834 added 4 November 2026, due 18 November 2026 — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Apple, About the security content of Safari 17.5 — https://support.apple.com/en-us/120896
- Apple, About the security content of iOS 16.7.8 and iPadOS 16.7.8 — https://support.apple.com/en-us/120898
- Apple, About the security content of iOS 17.5 and iPadOS 17.5 — https://support.apple.com/en-us/120905
- Apple, About the security content of macOS Sonoma 14.5 — https://support.apple.com/en-us/120903
- Apple, About the security content of tvOS 17.5 — https://support.apple.com/en-us/120901
- Apple, About the security content of watchOS 10.5 — https://support.apple.com/en-us/120902
- NVD, CVE-2024-27834 — https://nvd.nist.gov/vuln/detail/CVE-2024-27834
