CISA Adds Actively Exploited Apple Flaw to KEV Catalogue

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalogue on 4 November 2026. The Apple Multiple Products Improper Authentication Vulnerability affects Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5, and could let an attacker with arbitrary read and write capability bypass pointer authentication.

The flaw is an improper authentication vulnerability. The available description says an attacker must have arbitrary read and write capability to exploit it; it does not specify an initial attack vector. The vulnerability is rated CVSS 5.5, Medium. Patch status is listed as unknown, and no patch or advisory URL is provided in the supplied data. Apple support links are included in the KEV entry.

KEV inclusion confirms that the vulnerability is being actively exploited. The entry does not confirm whether it has been used in ransomware campaigns; that information is unknown. CISA set a remediation deadline of 18 November 2026.

CISA requires organisations to apply mitigations in accordance with vendor instructions and ensure compliance with BOD 26-04 guidance and CISA’s Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must evaluate each asset’s internet exposure and adhere to BOD 26-04 patching guidelines.

Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s requirements. Other organisations should also review their exposure and apply relevant mitigations.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2024-27834) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.