Apple CVE-2024-27834 actively exploited: update devices
CISA confirms exploitation of CVE-2024-27834 in WebKit. Check iPhones, iPads, Macs, Apple TVs and Watches, then update the business fleet.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 5 November 2026
- READING TIME
- 9 min read
- TOPIC
- Vulnerabilities and CVEs
CISA has added CVE-2024-27834 in WebKit to its Known Exploited Vulnerabilities catalog. The issue affects multiple Apple products and may allow an attacker who already has arbitrary memory read and write capability to bypass Pointer Authentication, a protection designed to make control-flow hijacking harder.
Apple fixed the vulnerability in updates released in May 2024, including iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. The new development on November 4, 2026, is therefore not the patch itself but CISA’s confirmation that attackers are exploiting the flaw in real incidents.
The priority action: check every Apple device, not only executive phones. Include older iPhones and iPads, Macs on supported releases, Apple TVs in meeting rooms and Watches used for notifications or authentication. Devices that cannot reach a supported version should be replaced or separated from business data.
What CISA has confirmed
CVE-2024-27834 entered KEV on November 4, 2026. CISA set a November 18 remediation deadline for US federal agencies covered by its directive. The deadline is formally specific to those agencies, but KEV is a useful prioritisation signal for every organisation because an entry means CISA has credible evidence of active exploitation.
CISA lists iOS, iPadOS, macOS, Safari, tvOS and watchOS. Ransomware campaign use remains “Unknown.” Public sources do not identify an attacker, campaign or victim count, so attribution would be speculation without further evidence.
Apple describes the impact as a Pointer Authentication bypass for an attacker with arbitrary read and write capability. Improved checks in WebKit addressed the issue.
Why this is more than “a browser bug”
WebKit is the engine that renders web content across Apple’s ecosystem. It processes pages and other web content beyond deliberate browsing in Safari. WebKit security therefore matters to the whole device and to apps that embed web views.
CVE-2024-27834 is not described as a standalone entry point. The attacker first needs arbitrary memory read and write capability. In practice, the issue can form part of an exploit chain: one vulnerability corrupts memory, and CVE-2024-27834 helps bypass a further defence on the path to code execution.
That distinction matters. It would be inaccurate to claim that this CVE alone can compromise every unpatched iPhone through one request. Active exploitation nevertheless shows that attackers can incorporate the technique into a working chain, so “it needs another bug” is not a reason to defer the update.
Releases that contained the original fix
| Product | Release containing the fix |
|---|---|
| iOS and iPadOS for newer devices | 17.5 |
| iOS and iPadOS for selected older devices | 16.7.8 |
| macOS Sonoma | 14.5 |
| Safari for macOS Monterey and Ventura | 17.5 |
| tvOS | 17.5 |
| watchOS | 10.5 |
These are the historical releases in which Apple originally fixed CVE-2024-27834. The appropriate target today is the latest version available for each supported model, not a downgrade to the minimum version listed above.
Treat hardware running an older release or no longer receiving security fixes as non-compliant. A major-version number alone is not enough without the patch date, particularly where MDM policy permits long update deferrals.
What individual users should do
1. Update every device
Check Software Update on iPhone, iPad and Mac. Confirm separately that Apple Watch and Apple TV have not remained on an old release.
2. Enable automatic updates
Automatic download and installation reduce exposure time. Verify that installation completed: limited storage, lack of charging or a device being powered off for long periods can interrupt the process.
3. Check whether the device is still supported
If the vendor no longer offers a secure release for the model, do not use it for banking, business email, passwords or authentication codes. Applications continuing to run does not mean the operating system remains safe.
What businesses with Apple fleets should do
Export the device inventory from MDM, including active OS versions, owners, last check-in and compliance status. Review shared equipment separately: Apple TVs, test devices, kiosk iPads and Macs used only occasionally.
Set a minimum OS level aligned with current vendor support and restrict mail, VPN, cloud data and business apps for devices below the threshold. A short update deferral for testing can be reasonable, but an unjustified multi-week window turns quality control into permanent exposure.
For high-risk devices, review EDR or mobile threat defence alerts, unusual processes and configuration profiles, account changes, service sign-ins and activity predating the update. Installing a fix removes the vulnerability but does not determine whether the device was previously compromised.
Our smartphone security guide provides additional practical steps for users.
Source facts and Breachroad conclusions
The source-confirmed facts are the addition of CVE-2024-27834 to KEV, active exploitation and the November 18 deadline for covered federal agencies. Apple confirms the Pointer Authentication impact, the WebKit component and fixes in the listed releases. The sources do not disclose an actor, scale or complete exploit chain.
Inventorying Apple TVs, restricting non-compliant devices, reviewing telemetry after patching and retiring unsupported hardware are Breachroad recommendations based on the active-exploitation risk. Teams can prepare users and administrators through cybersecurity training for organisations, while an IT security audit can assess fleet visibility and update processes.
FAQ: Apple CVE-2024-27834
Does the vulnerability affect only iPhones?
No. CISA also lists iPads, Macs, Safari, Apple TV and Apple Watch. All of these device groups need review.
Is the patch new?
No. Apple released the fix in May 2024. The new information in November 2026 is the KEV addition, confirming that the flaw is being exploited.
Is CVE-2024-27834 sufficient by itself to compromise a device?
The description says the attacker must already have arbitrary read and write capability. It is therefore likely a link in an exploit chain rather than a standalone entry point.
Has CISA confirmed ransomware use?
No. The ransomware field is “Unknown.” Active exploitation of the vulnerability is confirmed, but not a particular criminal business model.
Primary sources: CISA — Known Exploited Vulnerabilities Catalog, Apple — iOS 17.5 and iPadOS 17.5, Apple — Safari 17.5, Apple — macOS Sonoma 14.5.
