CISA adds Apple pointer authentication bypass CVE-2024-27834 to the KEV catalog
CISA now lists CVE-2024-27834, an Apple Pointer Authentication bypass first published in NVD in 2024, as exploited; federal agencies must act by 2026-11-18.
What CISA added
On 2026-11-04 CISA added CVE-2024-27834 to its KEV catalog of known exploited vulnerabilities. The entry is named “Apple Multiple Products Improper Authentication Vulnerability” and is classed as CWE-287, improper authentication. According to the KEV description, Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS contain a flaw “which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.”
Known ransomware campaign use is listed as Unknown. For US federal civilian agencies bound by BOD 22-01, the due date is 2026-11-18.
The flaw and the fix
NVD published the record on 2024-05-14, and its current status is Modified. The NVD description is short: “The issue was addressed with improved checks.” It lists the releases that carry the fix:
- Safari 17.5
- iOS 16.7.8 and iPadOS 16.7.8
- iOS 17.5 and iPadOS 17.5
- macOS Sonoma 14.5
- tvOS 17.5
- watchOS 10.5
The precondition matters for triage. Both descriptions start from an attacker who already has arbitrary read and write capability; the record does not say how that capability is obtained, only that such an attacker may be able to bypass Pointer Authentication. In other words, the flaw is described as a way around a protection, not as a way into a device on its own.
The fix itself is old. The listing date and the NVD publication date are far apart, so devices that have taken the updates listed above since 2024 are already covered, while anything still running an earlier release is exposed to a flaw that is now on the exploited list.
Severity
NVD, as the primary scorer, rates the flaw at CVSS 3.1 base score 5.5 MEDIUM with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. A secondary CVSS 3.1 score from a second source gives the same score and vector. Read field by field, the vector describes a local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high integrity impact and no confidentiality or availability impact.
A medium base score and a KEV listing answer different questions. The score rates the flaw in isolation, while the listing records that CISA treats it as exploited.
What to do
The required action is to apply mitigations in accordance with vendor instructions, following CISA’s BOD 26-04 guidance on prioritizing security updates based on risk and its “Forensics Triage Requirements”. Where mitigations are unavailable, the guidance is to discontinue use of the product, and stakeholders are responsible for evaluating each asset’s internet exposure.
For fleets of Apple devices, the practical check is whether every device runs at least the fixed release for its platform. Apple’s advisories are linked from the NVD entry and the KEV notes, alongside Full Disclosure and oss-security mailing list posts from May 2024.
Source: CVE-2024-27834 (NVD, CISA KEV)