CISA adds Apple WebKit pointer-authentication bypass CVE-2024-27834 to KEV; fixed in iOS 17.5 / 16.7.8, macOS Sonoma 14.5, Safari 17.5 and May 2024 tvOS/watchOS
- Fixed versions (Apple): iOS/iPadOS 17.5 (iPhone XS and later) and 16.7.8 (iPhone 8/8 Plus/X, older iPads); macOS Sonoma 14.5; Safari 17.5 on macOS Monterey and Ventura; tvOS 17.5; watchOS 10.5. Anything newer also has the fix.
- What to do: use MDM to find any Apple device still below those builds, especially iPhone 8/X-era phones that stopped at iOS 16, and update or retire them.
- Context: CISA's entry doesn't name the attacker and lists ransomware use as Unknown. Sekoia's APT29 watering-hole report (see our hunting item from earlier today) shows CVE-2024-27834 used to bypass PAC in an iOS 16.7 chain that steals Safari cookies.
- NVD gives it a CVSS 3.1 score of 5.5. The KEV listing is the reason to prioritize it, not the score.
Sources: CISA Known Exploited Vulnerabilities catalog (CVE-2024-27834, added Nov 4, 2026) · Apple: About the security content of iOS 17.5 and iPadOS 17.5 · Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8 · Apple: About the security content of macOS Sonoma 14.5 · Apple: About the security content of Safari 17.5 · Apple: tvOS 17.5 · Apple: watchOS 10.5 · NVD: CVE-2024-27834 · Sekoia: Poisoned Source (APT29 n-day mobile exploit chains)