---
title: CISA adds Apple WebKit pointer-authentication bypass CVE-2024-27834 to KEV; fixed in iOS 17.5 / 16.7.8, macOS Sonoma 14.5, Safari 17.5 and May 2024 tvOS/watchOS | ctxsec
url: https://ctxsec.com/items/kev-apple-cve-2024-27834-webkit-pac-bypass-added-nov-4
description: "CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on Nov 4, with a Nov 18 deadline for federal agencies. It's a WebKit flaw that lets an attacker who already has arbitrary read and write access bypass Pointer Authentication (PAC), which makes it a building block in exploit chains rather than a standalone attack. Apple fixed it in May 2024: Safari 17.5 (macOS Monterey and Ventura), iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Manfred Paul reported it through Trend Micro's Zero Day Initiative. CISA doesn't say who exploited it. Sekoia's Nov 4 APT29 'Poisoned Source' report describes it as the PAC-bypass stage of an iOS 16.7 exploit chain."
status: "official (CISA KEV, added Nov 4, due Nov 18; Apple advisories, May 2024 fixes)"
published: 2026-11-04
---

> CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on Nov 4, with a Nov 18 deadline for federal agencies. It's a WebKit flaw that lets an attacker who already has arbitrary read and write access bypass Pointer Authentication (PAC), which makes it a building block in exploit chains rather than a standalone attack. Apple fixed it in May 2024: Safari 17.5 (macOS Monterey and Ventura), iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Manfred Paul reported it through Trend Micro's Zero Day Initiative. CISA doesn't say who exploited it. Sekoia's Nov 4 APT29 'Poisoned Source' report describes it as the PAC-bypass stage of an iOS 16.7 exploit chain.

[← Cybersecurity News](/news) · [markdown](/items/kev-apple-cve-2024-27834-webkit-pac-bypass-added-nov-4.md)

official (CISA KEV, added Nov 4, due Nov 18; Apple advisories, May 2024 fixes)

2026-11-04

### CISA adds Apple WebKit pointer-authentication bypass CVE-2024-27834 to KEV; fixed in iOS 17.5 / 16.7.8, macOS Sonoma 14.5, Safari 17.5 and May 2024 tvOS/watchOS

- **Fixed versions (Apple):** iOS/iPadOS 17.5 (iPhone XS and later) and 16.7.8 (iPhone 8/8 Plus/X, older iPads); macOS Sonoma 14.5; Safari 17.5 on macOS Monterey and Ventura; tvOS 17.5; watchOS 10.5. Anything newer also has the fix.
- **What to do:** use MDM to find any Apple device still below those builds, especially iPhone 8/X-era phones that stopped at iOS 16, and update or retire them.
- **Context:** CISA's entry doesn't name the attacker and lists ransomware use as Unknown. Sekoia's APT29 watering-hole report (see our hunting item from earlier today) shows CVE-2024-27834 used to bypass PAC in an iOS 16.7 chain that steals Safari cookies.
- NVD gives it a CVSS 3.1 score of 5.5. The KEV listing is the reason to prioritize it, not the score.

Sources: [CISA Known Exploited Vulnerabilities catalog (CVE-2024-27834, added Nov 4, 2026)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Apple: About the security content of iOS 17.5 and iPadOS 17.5](https://support.apple.com/en-us/120905) · [Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8](https://support.apple.com/en-us/120898) · [Apple: About the security content of macOS Sonoma 14.5](https://support.apple.com/en-us/120903) · [Apple: About the security content of Safari 17.5](https://support.apple.com/en-us/120896) · [Apple: tvOS 17.5](https://support.apple.com/en-us/120901) · [Apple: watchOS 10.5](https://support.apple.com/en-us/120902) · [NVD: CVE-2024-27834](https://nvd.nist.gov/vuln/detail/CVE-2024-27834) · [Sekoia: Poisoned Source (APT29 n-day mobile exploit chains)](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits)