Apple CVE-2024-27834 PAC bypass added to CISA KEV after active exploitation

What happened

On November 4, 2026, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog “based on evidence of active exploitation.” The agency lists the flaw as “Apple Multiple Products Improper Authentication Vulnerability” (CISA).

The Hacker News describes it as a medium-severity flaw. Both The Hacker News and Security Affairs report a CVSS score of 5.5. An attacker who already has arbitrary read and write capability on a device could use it to bypass Pointer Authentication (PAC). PAC is a hardware security feature in Apple processors that cryptographically signs pointers. The Hacker News reports that Apple fixed the flaw in May 2024 with improved checks. It also reports that the flaw was first shown as a zero-day at Pwn2Own Vancouver in March 2024.

Both outlets connect the KEV addition to a report by Sekoia. Sekoia attributed the activity to the Russia-linked group APT29 with “moderate to high confidence.” According to that report, the attackers delivered malicious JavaScript through three routes:

• compromised legitimate websites
• fake websites imitating popular ones
• a supply-chain compromise of Plerdy SEO Tracker

A zero-click exploit chain targeting Safari and Chrome then installed information-stealing malware that collects browser cookies and device data (The Hacker News, Security Affairs). Security Affairs quotes Sekoia as saying the chain uses CVE-2024-27834 as its PAC bypass, so that forged pointers can achieve code execution.

The Hacker News names CVE-2025-43529 as the WebKit remote code execution flaw in the chain. However, its text gives that same ID for the PAC bypass component too, which looks like an error. The exact CVE list for the full chain is not confirmed in these sources, and neither are fixed versions for CVE-2025-43529.

The federal remediation due date is November 18, 2026 (The Hacker News, Security Affairs). The two sources cite different directives:

• CISA’s alert refers to Binding Operational Directive 26-04 (CISA).
• Security Affairs cites BOD 22-01 (Security Affairs).

Am I affected?

You may be affected if you use any of these products below the fixed versions reported by The Hacker News and Security Affairs:

• iOS and iPadOS: fixed in 16.7.8 and 17.5
• macOS Sonoma: fixed in 14.5
• tvOS: fixed in 17.5
• watchOS: fixed in 10.5
• Safari: fixed in 17.5

The sources do not say which devices or users were targeted. Indicators of compromise are also not included in these sources.

What to do now

1. Update all Apple devices and Safari to at least the fixed versions listed above.
2. Use your device management tooling to find any unmanaged or outdated Apple devices, and update or retire them.
3. Federal civilian agencies should finish remediation by November 18, 2026. CISA encourages all organizations to prioritize KEV catalog entries (CISA).
4. If your sites use Plerdy SEO Tracker, review the Sekoia findings described by The Hacker News. Specific remediation steps for site owners are not confirmed in these sources.

Sources

• CISA: CISA Adds One Known Exploited Vulnerability to Catalog
• The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
• Security Affairs: U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog