US agency adds exploited Apple authentication flaw to catalog

CISA added an improper-authentication vulnerability affecting multiple Apple products to its Known Exploited Vulnerabilities catalog, known as KEV. In its 4 November 2026 alert, the US agency said it had evidence that the flaw, identified as CVE-2024-27834, was being actively exploited.

Apple had previously said it addressed the issue with improved checks in iOS 16.7.8 and iPadOS 16.7.8, released on 13 May 2024. Apple added the vulnerability entry to its security document on 10 June 2024.

What the flaw can do

Apple says an attacker who already has the ability to read and write data without restriction may be able to bypass Pointer Authentication, a protection used to check pointers in memory. Apple does not say the flaw itself gives an attacker that initial ability.

Apple lists the updates containing the fix as available for iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch and iPad Pro 12.9-inch 1st generation. CISA’s alert does not specify affected versions or identify the attackers, victims, scale or timing of the exploitation.

What agencies and organizations should do

In its alert, CISA says its directive BOD 26-04 requires federal civilian executive branch agencies to prioritize rapid fixes for high-risk KEV vulnerabilities on publicly exposed assets when exploitation would give an attacker total control. The directive defers action on lower-risk vulnerabilities and sets expectations for when agencies must check whether a system was compromised before a patch was applied.

The directive applies only to those federal agencies. CISA encourages other organizations to manage vulnerabilities based on risk and prioritize fixes for flaws in the catalog. The alert gives no specific remediation deadline for CVE-2024-27834.