Security fix · CVE-2024-27834

The issue was addressed with improved checks.

Q: Which versions are affected?

Compare what you have installed with apple/iphone os < 17.5; wpewebkit/wpe webkit < 2.44.2. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Q: What should an analyst verify?

CWE-287: Improper Authentication. EPSS 1.50%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published May 13, 2024 · catalog updated Nov 5, 2026 · Apple Multiple Products

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2024-27834 is in the CISA known-exploited catalog, due Nov 18, 2026. Confirm Apple Multiple Products against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Same product and reporting

CVE-2026-21589 · Critical · known exploited
CVE-2026-86950 · High · known exploited
CVE-2026-93616 · Critical · known exploited
CVE-2026-85102 · Critical · known exploited
CVE-2026-5430 · Critical · known exploited

Severity: Medium5.5
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 1.50%
Remediation: Remediation guidance
Affected products: cpe apple/ipados · cpe apple/iphone os · cpe apple/macos · cpe apple/safari · cpe apple/tvos · cpe apple/watchos

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe apple/ipados< 17.5
cpe apple/iphone os< 17.5
cpe apple/macos< 14.5
cpe apple/safari< 17.5
cpe apple/tvos< 17.5
cpe apple/watchos< 10.5
cpe webkitgtk/webkitgtk< 2.44.2
cpe wpewebkit/wpe webkit< 2.44.2
vendor Appleversion unspecified
vendor Apple Multiple Productsversion unspecified

How to fix CVE-2024-27834

Vendor action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Version check
Affected < 17.5
Advisory
Open the bsi record and follow its fix. CISA lists a due date of Nov 18, 2026.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2024-27834 is in the CISA known-exploited catalog, due Nov 18, 2026. Confirm Apple Multiple Products against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with apple/iphone os < 17.5; wpewebkit/wpe webkit < 2.44.2. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What should an analyst verify?

CWE-287: Improper Authentication. EPSS 1.50%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

May 14, 2024 · NIST NVD
Detected
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 4, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Nov 4, 2026 · NIST NVD
Updated
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 4, 2026 · NIST NVD
Updated
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 4, 2026 · EUVD
Updated
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 4, 2026 · NIST NVD
Updated
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 5, 2026 · EUVD
Updated
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Nov 18, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Sources

BSI CERT-BundGovernment advisoryCVE-2024-27834
Apple macOS: Mehrere Schwachstellen
wid.cert-bund.de
CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2024-27834
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability This type of vulnerability is a frequent attack vector for malicious
cisa.gov
CISA KEVConfirmed exploitationCVE-2024-27834
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
cisa.gov
CVE.orgVulnerability recordCVE-2024-27834
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2024-27834
30-day exploitation probability 1.50%
first.org
EUVDVulnerability recordEUVD-2024-25027
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
euvd.enisa.europa.eu
NIST NVDVulnerability recordCVE-2024-27834
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2024-27834
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
vulncheck.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

CISA KEVNov 6, 2026
EUVDNov 6, 2026
FIRST EPSSNov 6, 2026
CISA Cybersecurity AdvisoriesNov 6, 2026
BSI CERT-BundNov 6, 2026
VulnCheck KEVNov 6, 2026
NIST NVDNov 5, 2026
CVE.orgNov 4, 2026

Priority score

44/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability1/20
CVSS severity8/15
Public exploit0/10
Internet exposure0/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Medium

CVSS severity
5.5 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS probability
1.50% · p74.41%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Nov 4, 2026. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Stacks

Apple macOS Safari

Weakness

CWE-287
Improper Authentication
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.