CISA Adds Apple CVE-2024-27834 to Actively Exploited Vulnerabilities
CISA added CVE-2024-27834 to its KEV catalog. Apple fixed the vulnerability in May 2024, and organizations should verify the update status of their devices.
Apple CVE-2024-27834 has been added to the Known Exploited Vulnerabilities (KEV) catalog maintained by the U.S. agency CISA. The entry classifies the vulnerability as an authentication error in Apple products and signals that there is evidence of exploitation. Apple released fixes as early as May 2024.
According to CISA, organizations should deploy mitigations according to the manufacturer’s instructions. For administrators, this primarily means reviewing their device inventory and confirming that systems and applications are not running versions older than the May 2024 updates.
What Apple CVE-2024-27834 Enables
CVE-2024-27834 affects the Pointer Authentication mechanism. When publishing the fix, Apple stated that an attacker who already has the ability to arbitrarily read and write memory could bypass this protection mechanism.
Pointer Authentication is a hardware mechanism designed to protect pointers in memory. Based on the available description, the vulnerability itself therefore does not provide the stated initial ability to arbitrarily access memory; in Apple’s scenario, that ability is already assumed as a prerequisite for exploitation. Its inclusion in KEV, however, means the vulnerability should not remain only in the standard patching cycle.
CISA’s publicly available entry does not provide technical details about the observed exploitation, its scope, or a specific campaign. It therefore has not been confirmed that the vulnerability is being used on a large scale against ordinary users of Apple devices.
Fixes Have Been Available Since May 2024
Apple fixed the vulnerability in the iOS and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5 updates. This is therefore not an unpatched vulnerability. The risk primarily affects devices that remained on versions predating these fixes.
- iPhones and iPads should have at least iOS or iPadOS 17.5 installed.
- Computers running macOS Sonoma should have at least version 14.5.
- Administrators should also verify Safari, tvOS, and watchOS updates in affected environments.
Organizations should compare recorded versions with the update status and address exceptions, such as devices outside standard management or systems on which updates were deferred. In its KEV entry, CISA recommends using mitigations specified by the manufacturer—in this case, the available Apple updates.
What to Watch Next
Details about who exploited the vulnerability and how have not yet been disclosed. It will be important to see whether CISA or Apple provides additional technical information, details about the scope of observed exploitation, or potential forensic indicators. For users and administrators, however, the current step is clear: verify that the fixes for Apple CVE-2024-27834 are installed on supported devices.
Sources
- CISA Known Exploited Vulnerabilities Catalog – The entry lists CVE-2024-27834 in the KEV catalog, describes its impact, and recommends applying the manufacturer’s mitigations.
- Apple – About the security content of iOS 17.5 and iPadOS 17.5 – Apple lists the CVE-2024-27834 fix and describes the possibility of bypassing Pointer Authentication when arbitrary read and write capabilities are available.
- NVD – CVE-2024-27834 – Confirms the affected product lines and the fixed versions published by Apple.
Verified and updated: 05. 11. 2026 06:20
