CISA adds Apple pointer authentication bypass CVE-2024-27834 to exploited list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, setting a remediation due date of November 18, 2026.

CISA describes the flaw as an improper authentication vulnerability (CWE-287) in Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication. CISA lists known ransomware campaign use as "Unknown."

## Patches shipped in May 2024

Apple fixed the issue in updates released May 13, 2024. According to Apple's advisories, the fix shipped in Safari 17.5 for macOS Monterey and macOS Ventura ([HT 120896](https://support.apple.com/en-us/120896)) and in iOS 16.7.8 and iPadOS 16.7.8 for iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch and iPad Pro 12.9-inch 1st generation ([HT 120898](https://support.apple.com/en-us/120898)). CISA's entry also references Apple's other May 2024 advisories (120901, 120902, 120903, 120905).

Apple credits the discovery to Manfred Paul (@_manfp) working with Trend Micro's Zero Day Initiative.

## What to do

CISA directs agencies to apply vendor mitigations by the due date or discontinue use of the product if mitigations are unavailable. Users of affected Apple devices should confirm they are running the patched versions or later.

Sources: [CISA KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), [Apple 120896](https://support.apple.com/en-us/120896), [Apple 120898](https://support.apple.com/en-us/120898).