CVE-2024-27834 — a medium-severity vulnerability that can bypass Pointer Authentication — was added to CISA's Known Exploited Vulnerabilities catalog, and Federal Civilian Executive Branch agencies were given a November 18, 2026 deadline to apply the necessary patches.
CISA listing and the November 18, 2026 remediation deadline
The U.S. Cybersecurity and Infrastructure Security Agency on Wednesday added CVE-2024-27834 (CVSS score: 5.5) to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. In light of that activity, CISA recommended that Federal Civilian Executive Branch (FCEB) agencies apply the vendor fixes by November 18, 2026.
What CVE-2024-27834 is and where Apple fixed it
The vulnerability is described as an improper authentication flaw that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication. Apple addressed the issue in May 2024 with "improved checks" in a range of releases: iOS 16.7.8 and iPadOS 16.7.8; iOS 17.5 and iPadOS 17.5; macOS Sonoma 14.5; tvOS 17.5; watchOS 10.5; and Safari 17.5. The flaw was demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSekoia report and attribution to APT29
The KEV addition followed reporting from Sekoia that linked active attacks to threat actors possibly tied to Russia. Sekoia said the activity exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data. That activity was attributed to APT29 (aka Cozy Bear and Midnight Blizzard), a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with "moderate to high confidence."
The exploit chain, browser-stage JavaScript, and the Plerdy supply-chain pathway
Sekoia described attacks that use malicious JavaScript delivered via three initial access pathways: compromised legitimate websites, fake sites masquerading as popular sites, and a supply-chain attack aimed at Plerdy SEO Tracker. The JavaScript profiles the visitor's device and, if conditions are met, triggers the vulnerability and ultimately deploys an information-stealing payload.
The reporting details a zero-click exploit chain that combines CVE-2025-43529 — described as a remote code execution flaw in WebKit — and CVE-2025-43529 — described as the pointer authentication codes (PACs) bypass — to execute a JavaScript payload designed for browser cookie theft. According to Sekoia, the overall effect is delivery of malware that harvests browser and device data after the malicious script confirms a viable target.
What this means for FCEB agencies, technologists, and end users
- FCEB agencies: Apply the Apple updates listed in May 2024 across supported devices by the November 18, 2026 remediation recommendation to align with CISA's KEV guidance.
- Technologists and security teams: Watch for malicious JavaScript delivered from compromised or fake sites and monitor for indicators related to the Plerdy SEO Tracker supply-chain vector; prioritize patch deployment for the Apple builds named in the advisory.
- End users and device owners: Ensure devices run the patched Apple releases cited (iOS 16.7.8 / 17.5 builds, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, Safari 17.5) to reduce exposure to the browser-based, information-stealing activity described by Sekoia.
The addition of CVE-2024-27834 to CISA's KEV catalog, the Sekoia report tying exploitation to previously patched browser flaws, and the attribution to APT29 together compress the window for remediation: agencies and organizations that have not applied Apple's May 2024 fixes now face a defined operational date to reduce known risk from an active, information-stealing campaign.
