A two-year-old Apple bug just landed on the US government’s must-patch list.
On November 4, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. CISA describes it as an improper authentication flaw in Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS that could let an attacker with arbitrary read and write capability bypass pointer authentication.
Old bug, new use
The Hacker News reports that the flaw carries a CVSS score of 5.5 and was fixed by Apple in May 2024 in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
The KEV listing follows a Sekoia report that hackers linked to Russia’s APT29 used previously patched Safari and Chrome flaws, including this one, to deliver malware that harvests browser and device data. The attacks used compromised legitimate websites, fake sites impersonating popular ones and a supply chain compromise of an SEO tracker.
What CISA requires
Federal Civilian Executive Branch agencies must apply mitigations by November 18, 2026, under Binding Operational Directive 26-04, or stop using the product if mitigations are not available. CISA’s catalog lists Apple’s support advisories for the affected products. The agency notes that this type of vulnerability is a frequent attack vector and poses significant risks to the federal enterprise.
The day before, CISA added a WordPress Core race condition flaw, CVE-2026-119977, to the same catalog, so it has been a busy week for patch teams.
Why it matters
KEV deadlines apply to federal agencies, but many private companies use the catalog to set their own patch priorities. A bug being old does not make it safe if devices in your fleet are still unpatched.
For IT service providers and security vendors, KEV additions are useful, timely hooks for client check-ins. Offer a quick audit of Apple devices still running outdated OS versions.
Source: CISA, The Hacker News. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.