CVE-2024-27834 Exploited in the wild
Apple Multiple Products Improper Authentication Vulnerability
- Risk score
- 68/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 14 May 2024
- Added to CISA's exploited list
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apple products have an improper authentication vulnerability. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
- Affected
- {'products': ['Safari', 'iOS', 'iPadOS', 'macOS', 'tvOS', 'watchOS'], 'packages': [], 'versions': ['Safari 17.5', 'iOS 16.7.8', 'iPadOS 16.7.8', 'iOS 17.5', 'iPadOS 17.5', 'macOS Sonoma 14.5', 'tvOS 17.5', 'watchOS 10.5']}
- Fix
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”
- Exploitation
- Exploited in the wild
Story map
At a glance
Apple Multiple Products: Red, act today. An out-of-bounds write issue in Apple products allows arbitrary code execution. An attacker could exploit this by processing a maliciously crafted file.
The flaws
- CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability (CVSS 5.5 · EPSS 1% · exploited)
- CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability (CVSS 8.8 · EPSS 26% · exploited)
The fix
Fix: Apply mitigations in accordance with vendor instructions or upgrade to iOS 27 or later, iPadOS 27 or later, macOS Sequoia 17 or later, or macOS Tahoe 27 or later
Who is exposed: {'products': ['iOS', 'iPadOS', 'macOS'], 'packages': [], 'versions': ['iOS 26.7.1 and earlier', 'iPadOS 26.7.1 and earlier', 'macOS Sequoia 15.8.1 and earlier', 'macOS Tahoe 26.7.1 and earlier']}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 29 Sep
- US federal deadline 13 Oct
- 6 outlets covering it
How it unfolded
- 29 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (2 of these flaws)
- 13 Oct, Deadline (official): US federal agencies must have patched
- 26 Oct, SANS Internet Storm Center (press): Apple Patches for October 2026, (Mon, Oct 26th)
- 27 Oct, BleepingComputer (press): Apple backports CoreGraphics zero-day patches to older iPhones
- 4 Nov, Infosecurity Magazine (press): APT29 Watering Holes Target Unpatched iPhones and Android Devices
- 4 Nov, Help Net Security (press): Russian hackers target iOS and Android users with n-day exploits
- 5 Nov, The Hacker News (press): Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
- 5 Nov, SecurityWeek (press): Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
Connects to
- Same weakness: Authentication bypass (CWE-287). 318 other warnings in 30 days
- Reported alongside: Apple Ipados: access control flaw. CVE-2026-86990 · in 1 of the same article
- Reported alongside: Apple Macos: access control flaw. CVE-2026-112467 · in 1 of the same article
In the news
TL;DR
Russian hackers exploit patched Apple flaw to steal user data
- Russian hackers target iOS and Android users with n-day exploits
- Exploit chains target previously patched vulnerabilities, including CVE-2024-27834
- Hackers use compromised websites and lookalike domains to deliver exploits
- Researchers attribute the operation to APT29, a Russian threat group
AI summary of 5 articles.
- Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
- Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
- Russian hackers target iOS and Android users with n-day exploits
- APT29 Watering Holes Target Unpatched iPhones and Android Devices
- Hackers use n-day exploits in zero-click attacks on iOS, Android devices
Why it is Amber
- CVSS 5.5 medium
- Exploited in the wild (CISA KEV)
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- https://support.apple.com/en-us/120896
- https://support.apple.com/en-us/120898
- https://support.apple.com/en-us/120901
- https://support.apple.com/en-us/120902
- https://support.apple.com/en-us/120903
- https://support.apple.com/en-us/120905
- http://seclists.org/fulldisclosure/2024/May/10
- http://seclists.org/fulldisclosure/2024/May/12
- http://seclists.org/fulldisclosure/2024/May/16
- http://seclists.org/fulldisclosure/2024/May/17
Original description
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Last activity 4 Nov 2026. Patch Forecast updates every hour.