---
title: Tip: today's Apple KEV entry is a 2024 bug, so the risk is the old iPhones and Macs your MDM stopped tracking | ctxsec
url: https://ctxsec.com/items/tip-find-apple-devices-below-may-2024-builds-kev-27834
description: "CVE-2024-27834 was fixed in May 2024, so devices on current releases are already safe. The exposure is the long tail: iPhone 8 and X-era phones capped at iOS 16, Macs left on Monterey or Ventura with an old Safari, and unmanaged personal devices that staff use for work mail or SSO."
status: "tip (based on CISA KEV and Apple advisories)"
published: 2026-11-04
---

> CVE-2024-27834 was fixed in May 2024, so devices on current releases are already safe. The exposure is the long tail: iPhone 8 and X-era phones capped at iOS 16, Macs left on Monterey or Ventura with an old Safari, and unmanaged personal devices that staff use for work mail or SSO.

[← Tips & Guides](/tips) · [markdown](/items/tip-find-apple-devices-below-may-2024-builds-kev-27834.md)

tip (based on CISA KEV and Apple advisories)

2026-11-04

### Tip: today's Apple KEV entry is a 2024 bug, so the risk is the old iPhones and Macs your MDM stopped tracking

- **MDM query:** list devices below iOS 16.7.8 (on 16.x), below iOS 17.5 (on 17.x), below macOS 14.5 (Sonoma), and Monterey or Ventura Macs with Safari older than 17.5.
- **Enforce:** set a minimum OS version in conditional access so outdated devices can't get SSO or mail tokens. That covers unmanaged phones MDM can't patch.
- **At-risk staff:** if a journalist's, executive's or Ukraine-linked staffer's old iPhone browsed widely, revoke its web sessions (the Sekoia chain targeted Safari cookies).

Sources: [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Apple: iOS 16.7.8 security content](https://support.apple.com/en-us/120898) · [Sekoia: Poisoned Source](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits)