News · eGov
A WebKit vulnerability in Apple platforms that can allow an attacker to bypass pointer authentication has been listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 18 November 2026.
✦ AI SUMMARY 30-second read
- CISA added CVE-2024-27834 to its KEV catalog on 4 November 2026, setting a federal remediation due date of 18 November 2026.
- Apple patched the flaw on 13 May 2024 across Safari, iOS, iPadOS, macOS, tvOS and watchOS; devices running current software are already protected.
- The vulnerability is classified CWE-287 and is most relevant as one component in a chain of exploits, not as a standalone entry point.
Why it matters: KEV listing signals active exploitation in the wild, making unpatched Apple devices in managed or supplier fleets an immediate remediation priority.
This summary was generated by AI. Editors may review and update it.
CISA on 4 November 2026 added CVE-2024-27834, a WebKit flaw affecting multiple Apple platforms, to its Known Exploited Vulnerabilities catalog. Federal agencies are required to remediate by 18 November 2026.
Apple had already addressed the issue on 13 May 2024 across a range of platform updates. Devices running those releases or any later software carry the fix and require no further action on this specific vulnerability.
The National Vulnerability Database scores the flaw at 5.5 under CVSS 3.1, a medium rating, though CISA's KEV listing elevates its operational priority given confirmed exploitation activity.
What the vulnerability does
Apple describes the flaw as enabling an attacker who already possesses arbitrary read and write capability to bypass Pointer Authentication, a hardware-backed memory protection mechanism on Apple silicon designed to make memory-corruption exploits harder to convert into code execution.
Because the attacker must first achieve arbitrary read and write access, the vulnerability is not an independent entry point. It is most significant as one link in a multi-stage exploit chain. Apple resolved the issue through improved checks in WebKit, referencing WebKit Bugzilla 272750.
CISA classifies the weakness as CWE-287 Improper Authentication. NVD's exploitation assessment rates it as active but not automatable, with partial technical impact. Neither Apple nor CISA has published exploitation details or indicators of compromise. Researcher Manfred Paul, working with Trend Micro's Zero Day Initiative, is credited with the discovery.
Affected and fixed versions
The fix was delivered in Safari 17.5 for macOS Monterey and Ventura, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. Any version earlier than these remains affected; all later releases include the patch.
For most managed fleets that applied updates in 2024, remediation is already complete. Organisations should focus on identifying stragglers such as devices pinned to older operating systems, unsupported hardware, or unmanaged kiosk and shared-use devices.
What organisations should do
Apple has published no workaround; updating to the fixed versions or later is the only mitigation. Mobile device management tools can identify devices that have not yet applied the relevant updates, and enforcing minimum OS version policies for corporate access will close residual exposure.
Third-party risk teams should ask suppliers whose staff handle sensitive data on Apple devices to confirm they enforce a minimum of iOS or iPadOS 17.5 (or 16.7.8), macOS 14.5, or a later release, and to demonstrate how non-compliant devices are detected and blocked. CISA's 18 November 2026 deadline provides a concrete target for supplier follow-up.