Apple iPhone, Mac and Safari Flaw Now Exploited: CVE-2024-27834

What has happened and what to do first

On 4 November 2026 CISA announced it had added one vulnerability to the KEV catalogue: CVE-2024-27834, listed as an Apple Multiple Products Improper Authentication Vulnerability. KEV entries require evidence of exploitation in the wild, so this is a step beyond a theoretical flaw. CISA's due date for US federal civilian agencies is 18 November 2026. That deadline does not bind UK businesses, but it is a reasonable benchmark for how quickly to move.

The fix is not new. Apple shipped it in May 2024, so a device that has taken ordinary updates since then is already covered for this specific flaw. The first job is an inventory question: which Apple devices in your organisation have not been updated in a long time? Start with anything that browses the web or opens untrusted content, which in practice means iPhones, iPads and Macs.

This page reflects what we could confirm as of 5 November 2026 (GMT). Information is still developing, and we explain below what has not been published.

Which Apple devices are affected

Apple's advisories list the flaw under WebKit, the engine behind Safari and used by browsers on iPhone and iPad. Apple lists the releases below as containing the fix. Reading those as the first fixed versions, anything older in the same line should be treated as exposed. That is our inference from the fix releases, not a version range Apple publishes.

Apple's current releases (for example iOS 26.7.2 and 27.2, listed on Apple's security releases page as released on 26 October 2026) are far newer than these. Apple has not, in the pages we checked, restated the fix for each of those later releases, so treat a current device as very likely fine but confirm it is genuinely on a supported, recent release.

• iPhone and iPad: iOS and iPadOS 17.5, or iOS and iPadOS 16.7.8 for iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch and iPad Pro 12.9-inch 1st generation.
• Mac: macOS Sonoma 14.5. On macOS Ventura and Monterey the fix is delivered through Safari 17.5.
• Apple TV: tvOS 17.5 (Apple TV HD and Apple TV 4K, all models).
• Apple Watch: watchOS 10.5 (Apple Watch Series 4 and later).
• We did not verify whether visionOS is affected, so we make no claim either way.

How serious is it

Apple describes the issue as one where an attacker who already has arbitrary read and write capability in a process may be able to bypass Pointer Authentication. Pointer Authentication is a hardware-backed protection that makes it harder for an attacker to redirect a program's execution after they have corrupted its memory. The flaw does not give an attacker a way in by itself. It removes one barrier after another bug has already given them memory access.

In practical terms, that makes this a likely link in an exploit chain, typically starting with a malicious web page or file. That is our reading of Apple's wording and the Zero Day Initiative advisory, which describes remote exploitation needing user interaction such as visiting a page or opening a file, with a CVSS score of 5.0. A moderate score on its own does not capture the KEV signal: someone is using it, probably alongside other bugs.

Not published, as far as we found: who is exploiting it, against whom, which other vulnerabilities are chained with it, or whether ransomware groups use it (CISA's data marks ransomware use as unknown). The ZDI advisory traces the bug to Pwn2Own research, but nothing we located links that to the exploitation CISA refers to. We name no victims and none have been publicly identified.

Check and update your devices

Updating is the fix. There is no vendor workaround we can recommend instead. Updates to iOS, iPadOS, watchOS and tvOS need the device to restart, so do them when people can spare it. Keep a laptop or phone on power and Wi-Fi while it installs. Large updates can take a while; wait until the device is fully back at its sign-in screen before relying on it.

1. On an iPhone or iPad, open Settings, then General, then About, and read the Software Version. Compare it with the list above. Then open General, then Software Update and install whatever is offered.
2. On a Mac, open the Apple menu, choose About This Mac to read the macOS version, then go to System Settings, General, Software Update and install what is offered. Older Macs running Ventura or Monterey should also update Safari through the same screen if it is offered separately.
   bashCopy

   sw_vers -productVersion

3. If you manage devices centrally, use your mobile device management (MDM) console to list OS versions across the fleet and push updates to any device below a recent release. Do this rather than relying on people to check individually, because the devices at risk are often the ones nobody is looking after.
4. Shared or kiosk iPads, Apple TVs in meeting rooms and spare phones in a drawer are the usual stragglers. Add them to the list. Anything you cannot update should not be used to browse the web or open files from outside your organisation.
5. Confirm success by re-reading the version number after the restart. It should now be at or above the fixed release for that device, ideally the latest one Apple offers for it.

If a device cannot be updated

Some older iPhones and iPads stop at a final iOS version and receive no more updates. If the device is on its last available release and that is at or above the fixed version for its line, it is covered for this flaw but will lack other protection as time goes on. If it cannot reach the fixed version, retire it from any work that touches the web, email attachments or company data.

If you have reason to think a device was used to open something suspicious, or it behaves oddly after being outdated for a long time, treat that as a security question rather than just an update question. Patching closes this route but does not undo anything an attacker did earlier. We have not seen public indicators of compromise for this flaw, so there is nothing specific to scan for beyond your normal endpoint and account monitoring. Check for unfamiliar sign-ins, new profiles or unexpected apps, and ask for specialist help if you see them.