Apple: Pointer Authentication bypass exploited (CVE-2024-27834)

On 4 November 2026 CISA added CVE-2024-27834, an improper authentication vulnerability in several Apple products, to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means that, according to CISA, the vulnerability is being exploited in real attacks. The fix is not new: it ships in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, updates from May 2024 (the NVD entry was published on 14 May 2024). The risk therefore concerns devices and systems that have not been updated since then.

The information in this article comes from a single source, the KEV catalog entry with NVD data: the advisory does not say who exploited the vulnerability, against whom, or since when.

What the vulnerability allows

According to the description published by NVD, an attacker who already has arbitrary read and write capability in memory may be able to bypass Pointer Authentication. Apple addressed the issue “with improved checks”.

Pointer Authentication (PAC) is the protection in Apple’s ARM-based processors that signs pointers with a cryptographic code and verifies it before they are used: it is meant to stop an attacker who can write to memory from hijacking the program’s execution flow. Bypassing it removes one of the barriers between a memory corruption bug and reliable code execution.

The description itself makes clear that CVE-2024-27834 is not enough on its own: it requires an arbitrary read and write capability obtained some other way, so it is used in an exploit chain together with at least one other vulnerability. The KEV entry does not say which.

Technical details

• CVE: CVE-2024-27834, classified by NVD as CWE-287 (improper authentication).
• CVSS 3.1: 5.5, medium severity, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, with the same score from NVD and from the CNA. Local attack, low complexity, low privileges, no user interaction, high impact on integrity.
• Affected products and versions (NVD CPE):
  • Safari before 17.5;
  • iOS and iPadOS before 16.7.8, and from 17.0 up to (but not including) 17.5;
  • macOS before 14.5 (Sonoma);
  • tvOS before 17.5 and watchOS before 10.5;
  • WebKitGTK and WPE WebKit before 2.44.2;
  • Fedora 39 and 40.
• Ransomware: according to CISA, use in ransomware campaigns is “unknown”.
• Deadline for US federal agencies: 18 November 2026.

Among the references in the NVD entry, alongside Apple’s bulletins, there is a third-party analysis by Sekoia whose address refers to watering holes attributed to APT29 targeting mobile devices with n-day exploits. Neither CISA nor NVD explicitly links the exploitation to that campaign, and the advisory lists no indicators of compromise. For the same reason we do not list MITRE ATT&CK techniques: the sources do not describe the attack chain.

Impact for European and Italian companies

The medium score can be misleading: what matters is that the vulnerability is exploited and serves to complete attack chains against Apple devices. The most exposed cases are:

• iPhones and iPads still on unpatched iOS 16 or 17, including shared units in wards, shops or warehouses and personal devices used for company email;
• Macs running macOS earlier than Sonoma 14.5, or with an outdated Safari;
• Linux workstations and systems with WebKitGTK or WPE WebKit earlier than 2.44.2; NVD specifically mentions Fedora 39 and 40.

For NIS2 entities, vulnerability management also covers smartphones, tablets and Macs: a flaw fixed more than two years ago and now confirmed as exploited is a good test of whether the device inventory is complete. In healthcare, where iPads and iPhones are often used to access clinical data, older devices should be checked first.

What to do now

1. Take inventory: from the MDM console, list iPhones and iPads on a version earlier than 16.7.8 or on a 17.x earlier than 17.5, Macs on macOS earlier than Sonoma 14.5, Apple TVs earlier than tvOS 17.5 and Apple Watches earlier than watchOS 10.5.
2. Update: the versions listed are the minimum for this vulnerability; where the device allows it, move it to the latest supported version, which also includes the fixes released since.
3. Check Linux: verify the version of the WebKitGTK and WPE WebKit packages and update them to at least 2.44.2 from the distribution’s repositories.
4. Handle devices that cannot be updated: for products without a fix, CISA says to discontinue their use; in a company this means removing their access to corporate data or replacing them.
5. Document: record the outcome of the check in the vulnerability management process, with the date and the devices involved.

How ARXDOME helps

On Macs and Linux machines the ARX Sentry agent collects the system and software inventory, so it shows which machines are still running macOS earlier than Sonoma 14.5 or have WebKitGTK and WPE WebKit packages to update. ARX Shield lists open vulnerabilities by machine and by package, highlights those already exploited and tracks them until they are closed. For iPhones and iPads, the MDM console remains the point of control.

Last updated: 4 November 2026