# Apple Multiple Products: WebKit Pointer Authentication bypass (CVE-2024-27834) added to CISA KEV · pwn.watch

> Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS contained an improper authentication issue in WebKit that could let an attacker who already had arbitrary read and write capability bypass Pointer Authentication. Apple fixed it in Safari 17.5, iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5 (May 2024). CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog on Nov 4 2026 (due Nov 18 2026) based on evidence of active exploitation.

Page: https://pwn.watch/i/apple-multiple-products-cve-2024-27834 · generated 2026-11-05T01:46:21.883Z

## Status
- Severity: high · status: closed · patch: patched
- Product: Apple Multiple Products (WebKit)
- Started: 2026-11-04 · closed: 2026-11-04
- CVEs: CVE-2024-27834
- Affected: Safari before 17.5; iOS/iPadOS before 17.5 and before 16.7.8; macOS before Sonoma 14.5; tvOS before 17.5; watchOS before 10.5
- Fixed in: Safari 17.5; iOS 17.5 / iPadOS 17.5; iOS 16.7.8 / iPadOS 16.7.8; macOS Sonoma 14.5; tvOS 17.5; watchOS 10.5

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/apple-multiple-products-cve-2024-27834/feed.xml
- JSON Feed: https://pwn.watch/i/apple-multiple-products-cve-2024-27834/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/apple-multiple-products-cve-2024-27834.json
- This file: https://pwn.watch/i/apple-multiple-products-cve-2024-27834/llms.txt

## Updates (newest first)
- 2026-11-04: CISA adds CVE-2024-27834 to the Known Exploited Vulnerabilities catalog; federal agencies have until Nov 18 2026 to remediate. (https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog)
- 2024-05-13: Apple ships fixes for CVE-2024-27834 (WebKit Pointer Authentication bypass) in Safari 17.5, iOS/iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5; iOS/iPadOS 16.7.8 also includes the fix. (https://support.apple.com/en-us/120905)

## Fix brief
# Security brief: Apple Multiple Products: WebKit Pointer Authentication bypass (CVE-2024-27834) added to CISA KEV

Source: https://pwn.watch/i/apple-multiple-products-cve-2024-27834 · status: closed (closed Nov 4, 2026) · severity: high · updated Nov 5, 2026, 01:18 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS contained an improper authentication issue in WebKit that could let an attacker who already had arbitrary read and write capability bypass Pointer Authentication. Apple fixed it in Safari 17.5, iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5 (May 2024). CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog on Nov 4 2026 (due Nov 18 2026) based on evidence of active exploitation.

Severity detail: Actively exploited (CISA KEV, added 2026-11-04, due 2026-11-18). Requires an attacker who already has arbitrary read/write; patched since May 2024.

- Product: Apple Multiple Products (WebKit)
- CVE / advisory ids: CVE-2024-27834

## Affected versions
- Safari before 17.5
- iOS/iPadOS before 17.5 and before 16.7.8
- macOS before Sonoma 14.5
- tvOS before 17.5
- watchOS before 10.5

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Safari 17.5
- iOS 17.5 / iPadOS 17.5
- iOS 16.7.8 / iPadOS 16.7.8
- macOS Sonoma 14.5
- tvOS 17.5
- watchOS 10.5

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 4, 2026: CISA adds CVE-2024-27834 to the Known Exploited Vulnerabilities catalog; federal agencies have until Nov 18 2026 to remediate.
- May 13, 2024: Apple ships fixes for CVE-2024-27834 (WebKit Pointer Authentication bypass) in Safari 17.5, iOS/iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5; iOS/iPadOS 16.7.8 also includes the fix.

## Advisories
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2024-27834)](https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog) (CISA)
- [About the security content of iOS 17.5 and iPadOS 17.5 (CVE-2024-27834)](https://support.apple.com/en-us/120905) (Apple)
- [NVD: CVE-2024-27834](https://nvd.nist.gov/vuln/detail/CVE-2024-27834) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Caveats
startedAt uses CISA dateAdded (exploitation may have begun earlier). Vendor patches shipped May 2024.

---
Machine-readable: https://pwn.watch/i/apple-multiple-products-cve-2024-27834.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.