Just the facts. No fluff. RSS · About
NEW YORK Thursday, November 5, 2026

Technology

CISA Adds Apple Flaw to Exploited Vulnerabilities List

CISA notes active exploitation of a patched Apple security flaw.

New York Editorial News Desk November 5, 2026 1 min read

The Brief

  • CISA added CVE-2024-27834 to its KEV catalog after reports of active exploitation.
  • The flaw, patched by Apple in May 2024, was demonstrated as a zero-day in March.
  • Threat actors linked to Russia are suspected of exploiting the vulnerability.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation.

The vulnerability, which has a CVSS score of 5.5, involves improper authentication and allows attackers with arbitrary read and write access to bypass Pointer Authentication.

Apple addressed the flaw in May 2024 with updates to iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.

The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024.

CISA cited a report from Sekoia indicating that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting device data.

The attacks are attributed to APT29, a state-sponsored group affiliated with Russia's Foreign Intelligence Service, with moderate to high confidence.

More in Technology