CISA adds exploited Apple pointer-authentication flaw to KEV as researchers detail mobile attack chain

What Happened

On November 4, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834, a previously patched Apple WebKit security vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The listing signals that exploitation has been observed, not that Apple has discovered a new flaw or that every Apple device is compromised. The agency's record identifies a weakness that can let someone who already has arbitrary memory read-and-write capability bypass Apple's Pointer Authentication protection.

The timing matters. Apple shipped fixes in May 2024, but devices that have not received relevant security updates can remain exposed years after a patch is available. CISA's catalog assigns November 18, 2026 as the remediation due date for applicable US federal agencies. That federal deadline is not a blanket legal deadline for all consumers or businesses, although the warning is useful to any organization managing outdated Apple devices.

Why A Medium-scored Flaw Can Matter In A Real Attack

CVE-2024-27834 has been described in public vulnerability coverage as having a CVSS severity score of 5.5. A medium severity score does not mean exploitation is unimportant. Pointer Authentication is intended to make it harder for an attacker who can corrupt memory to redirect execution. A bypass can become valuable when combined with another flaw that grants initial code execution or memory access.

Apple's own May 2024 advisory described the potential to bypass Pointer Authentication where a malicious attacker already possessed arbitrary read-and-write capability, and said improved checks addressed the issue. This prerequisite is essential context: the pointer-authentication bypass is not, by itself, evidence that merely visiting any webpage on an updated phone compromises the device.

Researchers Identify An Exploit Chain

A November 4 investigation by Sekoia's Threat Detection and Research team provides context for the KEV addition. The researchers analyzed an operation that delivered exploit chains through compromised legitimate websites, impersonation domains and an intrusion into a Ukrainian web-analytics service. In one chain targeting an older iOS 16.7 environment, the researchers observed a WebKit remote-code-execution vulnerability, CVE-2025-43529, combined with the CVE-2024-27834 pointer-authentication bypass. The observed objective of that chain was to obtain browser cookies that could potentially be used to access authenticated web sessions.

Sekoia also documented separate chains aimed at other iOS versions and older Android Chrome builds. They involve different vulnerabilities and collection capabilities, so those findings should not be collapsed into a claim that CVE-2024-27834 alone affected Android or enabled every reported form of data theft. The investigation says the exploit chains used known, already patched vulnerabilities rather than new zero-days, and the researchers did not find these specific chains effective against fully updated devices.

The researchers assessed with moderate-to-high confidence that the wider campaign was run by APT29, a group they associate with Russia's foreign intelligence apparatus. That is Sekoia's analytic attribution, based on technical and operational indicators, not an official attribution made by CISA in its KEV notice. The public reporting also does not establish a complete count of successfully compromised individuals.

What Apple Patched, And When

Apple's support documents show that CVE-2024-27834 was addressed through May 13, 2024 security releases including iOS and iPadOS 16.7.8 and 17.5. Apple's published release information also covers Safari 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. These are historical fix versions, not a claim that they are the latest secure operating-system releases in November 2026. Administrators should consult Apple's current platform-specific security release documentation and deploy the newest compatible supported version.

The important distinction is between disclosure, patching and exploitation. The vulnerability was corrected in 2024; CISA added it to KEV in 2026 after evidence of abuse. A new KEV entry can therefore change operational priorities without introducing a newly disclosed software weakness.

Practical Guidance For Device Owners And Security Teams

For individuals, the immediate step is to install available operating-system and browser updates using official Apple settings and update channels. Older devices unable to run supported releases deserve particular scrutiny. Avoid unsupported firmware packages, and treat unexpected account sign-ins or repeated authentication prompts as reasons to review account security, not as proof that this specific exploit occurred.

For enterprises, identify Apple endpoints that still run vulnerable or unsupported versions. Mobile-device-management inventories, software-compliance policies and managed access controls can help prevent unpatched devices from reaching sensitive applications. Review unusual session activity and identity-provider logs where there are grounds to suspect compromise; changing a password alone might not invalidate a stolen active browser session, so session revocation can be important in a confirmed incident.

CISA recommends using KEV as an input to risk-based remediation. US federal civilian agencies should evaluate the listing and their obligations under the current Binding Operational Directive. Other organizations can use the same evidence to prioritize relevant assets while considering exposure, business value and compensating controls. Defensive teams should be cautious about drawing conclusions from an individual CVE score without considering how vulnerabilities combine in a chain.

What Is Confirmed — And What Is Not

Confirmed: CISA added CVE-2024-27834 to KEV on November 4, 2026; Apple documented fixes in May 2024; Sekoia published an analysis identifying use of this CVE in an exploit chain targeting outdated iOS environments. Independent reporting has also explained why active exploitation changes remediation urgency.

Not established by those facts: exploitation of every listed Apple product, a new unpatched zero-day, or universal compromise of consumer devices. The APT29 attribution belongs to Sekoia and carries the uncertainty the researchers assigned to it. For CyberGeek News, the responsible headline is that a patched Apple vulnerability is now confirmed exploited and that unpatched devices should be prioritized for updates.