A WebKit pointer authentication bypass Apple fixed in May 2024 is now on CISA KEV, due 18 November. Sekoia names it in an APT29 chain against iPhones on iOS 16.
CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on 4 November 2026, with federal agencies due to remediate by 18 November. The flaw is a WebKit Pointer Authentication (PAC) bypass that Apple fixed on 13 May 2024. The exposed population is anyone still running pre-May-2024 Apple software, above all iPhones and iPads that cannot move beyond iOS 16.
What the vulnerability is
Apple describes the bug as one where "an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication". It was fixed with improved checks (WebKit Bugzilla 272750) and credited to Manfred Paul working with Trend Micro's Zero Day Initiative. NVD scores it CVSS 3.1 5.5 (medium, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The score is low because the bug is not an entry point: the attacker needs memory read/write first. That is exactly why it is useful in an exploit chain, where it turns a memory-corruption primitive into usable code execution on PAC-enabled hardware.
NVD's KEV fields name it "Apple Multiple Products Improper Authentication Vulnerability" and quote the required action: apply vendor mitigations, follow BOD 26-04 and CISA's forensics triage requirements. (CISA's own catalog page returned an error when we fetched it, so the KEV details here come from NVD's copy.)
Who fixed what
Each platform advisory lists the CVE under WebKit, released 13 May 2024:
- iOS and iPadOS 17.5 (iPhone XS and later, and matching iPads)
- iOS and iPadOS 16.7.8 (iPhone 8, 8 Plus, X, iPad 5th generation, iPad Pro 9.7-inch and 12.9-inch 1st generation)
- macOS Sonoma 14.5
- Safari 17.5 for macOS Monterey and Ventura
- tvOS 17.5 and watchOS 10.5
Apple later added entries with reworded impact text on 10 June 2024 to several advisories. The fix is the same.
Is there a campaign?
Sekoia's "Poisoned Source" report, published the same day as the KEV addition, names CVE-2024-27834 as the Stage 2 PAC bypass in its "Class A" iOS exploit chain. That chain starts with a renderer remote code execution, CVE-2025-43529, and Sekoia attributes the wider watering-hole campaign to APT29 with moderate to high confidence. Its delivery host filters for iOS 16.7 and 16.7.10, and Sekoia says the chain should work from iOS 16.0 to 17.4. Sekoia describes all the exploited flaws as n-days already patched by the vendors before the campaign began.
What we cannot establish: the pages we could read do not say that CISA's listing is based on Sekoia's report. NVD lists the Sekoia post among its references for the CVE, and the timing matches, but the CISA catalog page was not readable. Treat the link as likely, not confirmed.
Where CVE-2024-27834 sits in the iOS chain Sekoia attributes to APT29.
Who is still exposed
- iPhone 8, 8 Plus, X and the older iPads in the iOS 16.7.8 list. 16.7.x is as far as they go, and Sekoia's chain targets that line. Check they are on the latest 16.7 release, not just 16.7.8.
- Any iPhone or iPad on iOS 17.4 or earlier, or iOS 16.7.7 or earlier.
- Macs on Sonoma before 14.5, and Monterey or Ventura machines with Safari older than 17.5.
- Apple TVs before tvOS 17.5 and watches before watchOS 10.5.
What to do
- Update every device to the current release for its hardware. Where an iPhone can run iOS 17 or later, move it off iOS 16.
- For hardware stuck on iOS 16.7.x, install the last 16.7 release, avoid untrusted browsing on it, and plan replacement.
- On Macs, update macOS or at least Safari to 17.5 or later.
- Use MDM reports to find devices below the fixed builds. Federal agencies must act by 18 November 2026; others should treat that as a sensible deadline.
- Follow the KEV action to review devices for compromise where exposure is plausible, per CISA's forensics triage guidance.