CISA added a medium-severity Apple flaw to its Known Exploited Vulnerabilities catalog on 4 November 2026, two and a half years after Apple shipped the fix. The severity score is 5.5, which is exactly why fleets skipped it.
What happened
CVE-2024-27834 is an improper authentication issue in WebKit. An attacker who already holds arbitrary read and write capability inside the browser can use it to bypass pointer authentication, one of the mitigations that makes finishing an iPhone or Mac exploit difficult. On its own it is not an entry point; in a chain it is the step that turns a memory bug into control of the device.
Apple fixed it in May 2024 with improved checks in iOS and iPadOS 17.5, iOS and iPadOS 16.7.8 for older hardware, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. The KEV entry has a remediation deadline of 18 November 2026 for US federal agencies.
Who is affected
CISA's listing states active exploitation. It follows research published this month describing a campaign that chains previously patched Safari and Chrome flaws to profile visitors and lift browser and device data.
- iPhones and iPads below iOS or iPadOS 17.5, and the older devices that cap out on the 16.7.8 branch.
- Macs below macOS Sonoma 14.5, plus anything still on an older major release.
- Shared and secondary devices: loan phones, demo units, reception iPads, field handsets that were never enrolled in a management system.
What to do now
Find every Apple device below iOS 17.5 or macOS 14.5 and update it, or take it off the network. A KEV listing is evidence of exploitation, not a prediction.
- Pull the OS version report from your MDM or Apple Business Manager and sort ascending. The tail of that list is the exposure.
- Update phones and Macs to the current release; the fix has existed since May 2024, so any device still behind it has missed roughly eighteen months of updates and a dozen other patches.
- For hardware that cannot reach 17.5, move it to 16.7.8 or retire it. An unmanaged iPhone holding corporate mail is the realistic path into a small business.
- Where a device was used to browse untrusted sites and cannot be verified, treat its stored credentials as exposed and rotate them.
What this means for South African businesses
Most SMEs here do not have an Apple fleet policy; they have staff who bought phones and connected them to mail. That is the population this bug lives in, and no vulnerability scanner will ever report it. The practical risk is low per device and high per organisation, because the one phone three versions behind belongs to the person who approves payments.
Source: CISA alert adding CVE-2024-27834 to the KEV catalog.
Also on the blog
- ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix
- Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.