Federal civilian agencies have until November 18 to close CVE-2024-27834, a pointer authentication bypass Apple fixed in May 2024. CISA added the entry to its Known Exploited Vulnerabilities catalog on November 4.
The flaw carries a median severity score of 5.5, which made its arrival on the list unusual. What triggered it was a research report published earlier the same week.
The patch that has been available for eighteen months
Apple closed the hole in iOS and iPadOS 16.7.8, iOS and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. A researcher demonstrated it as a zero-day at Pwn2Own Vancouver in March 2024.
Sekoia’s Poisoned Source report attributes a watering hole campaign to APT29, the SVR-linked group also tracked as Midnight Blizzard, with moderate to high confidence. Compromised websites, cloned lookalikes and a hijacked Ukrainian analytics script pushed visitors toward mobile exploit chains. One chain uses this bug to defeat pointer authentication and lift cookies out of Safari.
What the listing actually demands
Patch deadlines bite only where the device is still supported by its vendor. An iPhone stuck on a build Apple stopped signing in 2024 cannot be remediated by installing anything.
That leaves asset owners with two jobs: find the mobile estate that can still take the update, and account for the older hardware that cannot. For the second group, the exposure is the absence of a patch, not a missing one.
