[Urgent] Apple CVE-2024-27834: Added to CISA KEV on Nov 4 — A Flaw Fixed in May 2024 Was Used in Watering-Hole Attacks (Sekoia); Update to iOS 17.5 or Later (16.7.8 on 16.7 Devices) (CVSS v3.1 5.5)

CVE-2024-27834, a flaw in Apple's operating systems and browser, was added to CISA's KEV catalog on November 4, 2026. KEV is the US cybersecurity agency's list of vulnerabilities that have actually been exploited. Apple fixed this flaw on May 13, 2024, in iOS 17.5, iPadOS 17.5, iOS 16.7.8, macOS Sonoma 14.5, Safari 17.5 and others. Devices that are up to date are not affected. The attacks reported so far target iPhones; I could not confirm any attack on Macs.

First, check the version on your own device. On an iPhone or iPad, open Settings > General > About. If iOS is older than 17.5 (or older than 16.7.8 on models that stop at 16.7, such as the iPhone 8 and iPhone X), you need to update. Check family members' devices and old devices you no longer use as well.

Where the score comes from: 5.5 (CVSS v3.1) is the rating NVD lists from NIST itself and from CISA-ADP; both give the same value. The vector is local access, low complexity, low privileges required, no user interaction, and high integrity impact. Apple's description assumes the attacker already has arbitrary read and write capability. This flaw is a part used inside a chain of attacks, not a standalone way in. A medium score should not make you wait: the KEV listing is the stronger signal, so update.

What is happening (as far as it has been published)

• ▸CVE-2024-27834: Apple's advisories describe a flaw in WebKit (the browser core used by Safari and others) where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication (PAC), fixed "with improved checks." Pointer Authentication is a safety mechanism that makes hijacking a program harder. The credited reporter is Manfred Paul, working with Trend Micro's Zero Day Initiative
• ▸CISA KEV: Added on November 4, with a due date of November 18 (a deadline for US federal agencies). Use in ransomware campaigns is listed as "Unknown." The KEV entry names no attacker
• ▸Exploitation report (Sekoia, November 4): Security firm Sekoia's report says the flaw was used as part of iPhone exploit code in a large website-based campaign. As one infection vector, the report describes the compromise of the Ukrainian analytics tag "Plerdy" between August 27 and September 3, 2026, loaded by thousands of websites, the large majority of them Ukrainian
• ▸How it was used: The report says the flaw served as stage 2 (the Pointer Authentication bypass) of an exploit chain aimed at iOS 16.7, combined with CVE-2025-43529. The chain is said to work from 16.0 to 17.4. The goal was to steal browser cookies (the data that keeps you logged in); the report says stolen cookies could let attackers into logged-in services such as webmail
• ▸Who is behind it, in Sekoia's view: Sekoia assesses with "moderate to high confidence" that the group is APT29, widely linked to Russia's foreign intelligence service (SVR). This is Sekoia's analysis; neither CISA nor Apple has named an attacker
• ▸This is not a new flaw: The report says every flaw used had been fixed by its vendor before the campaign began and that an up-to-date OS is not affected. Devices where the fix was put off were the ones targeted. Apple's May 2024 advisories carry no "may have been exploited" note on this entry

Affected versions and the versions to move to

• ▸Fixed versions (all released May 13, 2024; confirmed in Apple's advisories): iOS 17.5 / iPadOS 17.5 for iPhone XS and later and similar. iOS 16.7.8 / iPadOS 16.7.8 for iPhone 8, 8 Plus, X, iPad (5th generation), iPad Pro 9.7-inch and 12.9-inch (1st generation). macOS Sonoma 14.5 for Mac; Safari 17.5 for macOS Monterey and Ventura. tvOS 17.5 for Apple TV HD and 4K, and watchOS 10.5 for Apple Watch Series 4 and later
• ▸NVD's affected range: Safari, iPadOS, iOS and tvOS before 17.5, watchOS before 10.5, and macOS from 14.0 up to (not including) 14.5. NVD also lists the Linux WebKitGTK and WPE WebKit before 2.44.2. NVD words the iOS condition broadly as "before 17.5," but Apple issued a separate fixed release, 16.7.8, for the 16.7 line. On a model that stops at 16.7, moving to 16.7.8 fixes this flaw
• ▸Keep updating even if you are on a newer OS. The report also describes another chain aimed at iOS 18.5 that used different CVEs (I did not confirm the fixed versions for those). Moving to the latest release is the safest course

What to do today

• ✓★Check the iOS or iPadOS version. Open Settings > General > About. If it is older than 17.5 (older than 16.7.8 on models that stop at 16.7), you are affected
• ✓★Update to the latest iOS. Go to Settings > General > Software Update. Turn on automatic updates so later releases are not missed. Back up first
• ✓On a Mac, move to macOS Sonoma 14.5 or later (Safari 17.5 or later on Monterey and Ventura). Apple TV needs tvOS 17.5 or later and Apple Watch watchOS 10.5 or later
• ✓Check family devices too. Old iPhones used by parents or children, phones kept before an upgrade, and devices left in a drawer all count
• ✓If you opened an unfamiliar site or a suspicious link on an old version, change the passwords of your important services as a precaution and review the list of logged-in devices. Because this attack steals cookies, remove any device you do not recognize (this is our general advice, not a step given by Apple or the report)

If you cannot update right away

None of the sources I could check (Apple's advisories, NVD, CISA KEV, Sekoia's report) gives a workaround for this flaw. An unofficial stopgap cannot be guaranteed to work, so I do not list one. This attack plants traps in legitimate websites, so "avoid suspicious sites" alone does not stop it. Put the update first and set the date now.

• ▸If your model is old and its fix is not listed on the Apple pages above: I could not confirm whether a fix exists for that model. Ask Apple Support or consider replacing the device
• ▸After updating, stay alert for a while to unexpected login notices or security warnings.

What we could not confirm

• ▸Damage in Japan or the scale of the attacks. None of the sources I could check described a case in Japan. Sekoia's report centers the victims on Ukraine
• ▸Who is responsible. The APT29 assessment is Sekoia's. CISA and Apple say nothing about the attacker
• ▸Fixed versions for the other CVEs in the report. I did not check CVE-2025-43529 and the rest
• ▸The fix status of Linux WebKitGTK and WPE WebKit. NVD lists them as affected, but I did not check the projects' own notices
• ▸Indicators of compromise. Sekoia's report lists the domains and file hashes used in the attacks; I do not reproduce them here. The report says it shares IoCs and samples that are not listed with national CERTs and law enforcement only

If you share this, share these 3 lines

• ▸Apple's CVE-2024-27834 was added to CISA's "known exploited" catalog (KEV) on November 4. It was fixed in May 2024, and old versions of iPhone were the targets (no attack on Macs confirmed)
• ▸★On an iPhone, check Settings > General > About; if iOS is older than 17.5 (older than 16.7.8 on models that stop at 16.7), update. Go to the latest iOS if you can, and check family devices
• ▸The attack plants traps in legitimate websites, so avoiding suspicious sites is not enough. Update first. The sources I could check gave no workaround

Pages this article is based on