CVE-2024-27834: Apple iOS, macOS and Safari flaw exploited in the wild

What it is and who is affectedCVE-2024-27834 is an improper authentication vulnerability (CWE-287) in Apple's software stack. According to the CISA de...

What it is and who is affected

CVE-2024-27834 is an improper authentication vulnerability (CWE-287) in Apple's software stack. According to the CISA description, iOS, iPadOS, macOS, Safari, tvOS and watchOS contain the flaw, which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. In plain terms, a component meant to protect memory pointers from tampering can be circumvented, weakening one of the defences modern Apple systems rely on.

The NVD entry, published on 14 May 2024, lists the affected ranges as Safari up to 17.5 (exclusive), iPadOS up to 17.5 (exclusive), iPhone OS up to 17.5 (exclusive), macOS from 14.0 (inclusive) to 14.5 (exclusive), tvOS up to 17.5 (exclusive) and watchOS up to 10.5 (exclusive). The same record also covers the WebKitGTK and WPE WebKit engines up to 2.44.2 (exclusive), plus Fedora 39 and Fedora 40.

Gravity is rated CVSS 3.1 at 5.5, which is MEDIUM (vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The local attack vector and the need for existing read and write capability mean this is not a flaw an anonymous visitor triggers from a browser tab. That nuance matters, but it should not be read as reassurance: the impact on integrity is high, and the flaw is being used.

Why it is urgent: already exploited, with a deadline

The decisive fact is that CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalogue on 4 November 2026. Inclusion in KEV means there is evidence of exploitation in real attacks, not merely a theoretical weakness. CISA has given US federal agencies until 18 November 2026 to remediate it.

The required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritising security updates based on risk, and to follow the applicable forensics triage requirements. Where mitigations are unavailable, the guidance points to discontinuing use of the product. CISA also places responsibility on asset owners to evaluate each system's internet exposure and to adhere to the BOD 26-04 patching guidelines.

The KEV entry does not record known use in ransomware campaigns. That is a statement about what is documented, not a guarantee about what will happen next, and it does not lower the priority of patching.

What to do today

Inventory what you run. Check iPhones, iPads, Macs, Apple TVs and Apple Watches across the company, including devices used for email and internal tools rather than only those issued centrally. Note the exact OS and browser versions.
Compare against the affected ranges. Anything below Safari 17.5, iOS and iPadOS 17.5, macOS 14.5, tvOS 17.5 or watchOS 10.5 falls inside the vulnerable window described by NVD. Older branches such as iOS and iPadOS 16.7.8 are also referenced in the fix list.
Apply the vendor advisory. Apple published guidance under HT214101, HT214102, HT214103, HT214104 and HT214106, plus reference 120896. Follow the update path those advisories specify for each product and version; do not assume a single release covers every device.
Do not forget the web engines. If your team builds or hosts services on WebKitGTK or WPE WebKit, or runs Fedora 39 or 40 in production, treat those as in scope and apply the updates indicated by the respective maintainers.
Look for signs of intrusion. Because exploitation requires local read and write capability, a compromise usually implies something else went wrong first. Review unusual process activity, unexpected configuration changes and anomalous access on endpoints that handle sensitive data.
Reduce exposure. Limit which internal services are reachable from the internet, restrict administrative access and keep high-value endpoints off untrusted networks until patching is confirmed.

How a cybersecurity team such as ALMC's can help

Most small and mid-sized companies in Barcelona, Lleida, Tarragona or Girona do not have the headcount to chase every KEV entry while also running their business. That is where an external team earns its keep: maintaining a live inventory of devices, servers and web platforms, mapping each one against advisories such as this one, and confirming that patches actually landed rather than assuming they did.

For organisations running WordPress, PrestaShop or Joomla alongside Apple hardware and their own servers, the work goes further. Security audits and pentesting reveal which weaknesses are genuinely reachable from outside. Server hardening and continuous monitoring close the gap between a published vulnerability and an exploited one. And when something does go wrong, incident response and repair of a hacked site limit the damage instead of discovering it weeks later.

The lesson from CVE-2024-27834 is not that Apple products are uniquely fragile. It is that a medium-severity flaw with a narrow attack path can still end up in CISA's KEV catalogue, and that the organisations which cope best are the ones with a routine for finding, patching and verifying, not the ones that react fastest after the fact.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.