Apple iOS · Exploitation confirmed

CISA confirms exploitation of Apple flaw in iOS and macOS

Nov 04, 2026 · 1 min read

CISA added CVE-2024-27834, an improper authentication flaw in iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, to the KEV catalog, indicating confirmed exploitation. An attacker with arbitrary read and write capability can bypass pointer authentication, a memory security feature. US federal agencies must apply fixes and mitigations by November 18, 2026.

By HIFY Radar newsroom Updated 11/04/2026 05:06 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation confirmedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CISA added Apple flaw CVE-2024-27834, present in iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, to its Known Exploited Vulnerabilities (KEV) catalog. Per the agency, the improper authentication flaw lets an attacker bypass pointer authentication, a memory protection.

Why it matters

KEV inclusion means CISA considers the flaw actively exploited. Apple devices running the listed systems can have this memory protection bypassed by attackers who already hold advanced read and write access. CISA lists ransomware use as unknown.

What to do

Update company Apple devices per vendor instructions and confirm installed versions. US federal agencies face a November 18, 2026 deadline; CISA advises discontinuing the product if mitigations are unavailable.

For the technical team

CVE: CVE-2024-27834
Affected: Apple iOS, iPadOS, macOS, Safari, tvOS e watchOS · iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, per the CISA description.
Exploitation: Exploitation confirmed by CISA adding CVE-2024-27834 to the KEV catalog. Ransomware use: unknown, per the CISA entry.
Fix: The source does not state fixed versions. CISA required action: apply mitigations per vendor instructions, following BOD 26-04, or discontinue the product if mitigations are unavailable.
Vector: Improper authentication in Apple products. Allows an attacker with arbitrary read and write capability to bypass pointer authentication, a memory security feature.
More details: Federal remediation deadline: November 18, 2026. CISA requires adherence to BOD 26-04 (Prioritizing Security Updates Based on Risk), to forensics triage requirements, and to evaluating each asset's internet exposure.