CISA KEV adds CVE-2024-27834: update Apple browsers and managed devices

Status at 6 November 2026: CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities (KEV) catalogue on 4 November 2026. The CVE was published on 13 May 2024; it is not new. KEV inclusion makes it a current patch-management priority.

At a glance

What is confirmed, and what is not

Apple records CVE-2024-27834 as a case where an attacker with arbitrary read and write capability may bypass Pointer Authentication; improved checks address it. CISA’s KEV entry says exploitation is known.

That establishes exploitation was reported to CISA and updates exist. It does not establish that every older Apple device is compromised, that the issue is remotely reachable without another weakness, or that browser history proves compromise. Do not reproduce the flaw. Use version, management and endpoint evidence.

Are you affected?

Start with asset inventory. In Jamf, Intune, Kandji or another MDM, export device name, serial number, OS version, last check-in, update state and assigned user. Match the exact build against Apple’s supported-release advisories.

On a Mac, a local administrator can safely collect evidence:

sw_vers
system_profiler SPApplicationsDataType | grep -A4 -i '^ *Safari'

Expected result: macOS product/build details and Safari’s installed version. Attach output to the change ticket; it is not an exploitation test.

On an iPhone or iPad, open Settings → General → About and record the version. In MDM, a device without a fresh check-in is not proven safe.

• Affected / action required: older than Apple’s applicable fixed release, or update policy failure.
• Not proven: no recent check-in or unclear branch.
• Not affected by this advisory: at or later than Apple’s fixed release for the branch, with recorded inventory evidence.

Patch: staged, vendor-supported update

Prerequisites

1. Confirm encrypted backup for user-managed devices, or enterprise backup/service coverage.
2. Confirm power, Wi-Fi and enough free storage on mobile devices.
3. Pilot a representative Mac group before broad deployment.
4. Preserve MDM inventory and recent telemetry before forcing updates. Patching is not a forensic conclusion.

macOS and Safari

For managed Macs, deploy Apple’s available software update through MDM to a pilot smart group first. For a local user:

1. Select Apple menu → System Settings → General → Software Update.
2. Select More info if Safari or a macOS update is offered.
3. Install the available Apple update; restart if asked.
4. Repeat the inventory command and record versions.

Expected result: updated macOS/Safari and a fresh management check-in.
Validation: MDM shows the version; Safari and required business apps start normally.
Rollback: Apple security updates are not normally rolled back in place. If a tested business application fails, isolate that device from untrusted browsing, use an approved backup/recovery process and escalate to the application owner. Do not downgrade merely to remove a patch.

iPhone and iPad

1. Open Settings → General → Software Update.
2. Install Apple’s current update for the hardware, or push it through MDM.
3. Keep power and network connected until restart completes.
4. Confirm the reported version in Settings → General → About or MDM.

Expected result: restart, current version and MDM check-in.
Validation: MDM compliance is current and managed apps open.
Rollback: iOS/iPadOS downgrade is not a standard rollback route; use Apple-supported recovery only with approval and a known-good backup.

Temporary risk reduction

A patch is remediation. If a device cannot be updated in the window, reduce opportunity:

• move it to a restricted network/VPN policy;
• remove privileged/admin use;
• require MDM check-in before sensitive SaaS;
• avoid untrusted links and documents;
• give every exception a dated owner and expiry.

These controls reduce exposure but do not remove the vulnerability. Escalate unmanaged or jailbroken devices.

Safe discovery and evidence

A safe check asks whether your own managed assets report a vulnerable version; it never sends crafted content or probes other systems. NetTools.tech has no relevant safe check for a local Apple OS/Safari build, so none is included.

Review EDR/MDM for devices behind on updates, unusual browser child processes, unexpected configuration-profile changes or management gaps. Those signals need triage; they do not prove CVE-2024-27834 exploitation. Preserve timestamps, device/user identity and logs before reset.

Timeline

• 13 May 2024: Apple released Safari 17.5 security content including CVE-2024-27834.
• 10 June 2024: Apple added the CVE to related older-branch notes.
• 4 November 2026: CISA added the CVE to KEV.
• 6 November 2026: this guidance was reviewed.

References

1. Apple, About the security content of Safari 17.5.
2. Apple, About the security content of iOS 16.7.8 and iPadOS 16.7.8.
3. CISA, Known Exploited Vulnerabilities Catalog, record for CVE-2024-27834.
4. NIST NVD, CVE-2024-27834.
5. FIRST, EPSS score for CVE-2024-27834.

Izmaiņu žurnāls

• 6 November 2026 — r1: Initial guidance after KEV addition; distinguished the 2024 CVE publication from the 2026 KEV addition.