CISA Adds Apple CVE-2024-27834 to KEV After APT29 Exploitation
First merged summary.
CISA added CVE-2024-27834 to its KEV catalog after APT29 exploited the Apple flaw in a zero-click chain to deliver malware to federal agencies.
CISA added an improper authentication vulnerability in multiple Apple products to its Known Exploited Vulnerabilities catalog. The flaw allows arbitrary read and write access to bypass pointer authentication. Russia-linked APT29 exploited it alongside other flaws in a zero-click chain via compromised websites, fake sites, and supply chain to deliver info-stealing malware to federal agencies. Federal agencies must apply patches by November 18, 2026.
- CVE-2024-27834 added to CISA KEV catalog
- Fixed in iOS 16.7.8/17.5, macOS 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5
- FCEB must patch by November 18, 2026
- Exploited in zero-click chain with Safari and Chrome bugs
- Delivers via compromised, fake sites and Plerdy supply chain
- Targets FCEB agencies and diplomatic sites in Europe and US
Timeline
dated events in the reporting · oldest first- Nov 4, 2026CISA added CVE-2024-27834 to Known Exploited Vulnerabilities catalog · CISA
- Nov 5, 2026APT29 exploited patched Apple flaw in zero-click chain to deliver malware · The Hacker News
- Nov 5, 2026CISA ordered federal agencies to remediate by November 18 · Security Affairs
- Nov 5, 2026Russia-linked APT29 hit high-profile sites via watering holes · SecurityWeek
What each outlet adds
beyond the shared facts- The Hacker NewsExploitation by APT29 in zero-click chain with supply chain attack
- Security AffairsFix versions and Sekoia attribution to APT29
- SecurityWeekWatering hole targets and additional exploit chains
- Threat actors
- APT29Midnight Blizzard
- Countries
- RussiaUnited StatesUkraineUSEurope
Coverage
oldest first · one row per article · UTC- · 5d ago
CISA Known Exploited VulnerabilitiesFirst report
Apple products contain pointer authentication bypass vulnerability
iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain improper authentication vulnerability allowing arbitrary read and write capability.
- · 4d ago
The Hacker News
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware
CISA added CVE-2024-27834 to its KEV catalog after APT29 exploited it in a zero-click chain to deliver browser data-stealing malware to FCEB agencies.
- · 4d ago
Security Affairs
CISA adds exploited Apple PAC bypass CVE-2024-27834 to KEV
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
- · 4d ago
SecurityWeek
Midnight Blizzard uses exploit chains in watering holes
Russia-linked APT29 deploys zero-click exploits via watering holes against iOS Android users in Europe and US targeting high-profile sites.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |