# CISA Adds Apple Pointer Authentication Bypass to Exploited Vulnerabilities List Federal agencies must patch CVE-2024-27834 by November 2026 to prevent memory-corruption attacks. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-05 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/b13e86cd-296c-45fd-9453-33171472229b ## CISA Updates Vulnerability Catalog The U.S. Cybersecurity and Infrastructure Security Agency has officially added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog. This flaw carries a CVSS score of 5.5 and specifically impacts Apple operating systems and the Safari browser. Federal agencies are now mandated to address this security risk to protect their enterprise networks from potential attacks. ## Mechanism of the Flaw The vulnerability allows attackers with existing arbitrary read and write capabilities to bypass Pointer Authentication. This hardware-based security feature, integrated into Apple processors, uses cryptographic signatures to protect memory addresses. By circumventing these protections, an attacker can weaken critical security barriers, making further device exploitation significantly easier for malicious cyber actors. ## Scope of Security Impact Bypassing Pointer Authentication weakens defenses against memory-corruption attacks. When combined with other vulnerabilities, this flaw facilitates deeper system exploitation. Because Pointer Authentication Codes cryptographically sign control-flow pointers, attackers cannot simply overwrite function pointers to hijack execution. This specific bypass is therefore a necessary component for achieving full arbitrary code execution. ## Apple's Remediation Efforts Apple addressed this security vulnerability by implementing improved checks across its software ecosystem. Patches were released in Safari 17.5, iOS 16.7.8, and iOS 17.5. Additionally, updates were provided for iPadOS 16.7.8, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. Users should ensure their devices are running these specific versions. ## Connection to APT29 Activity Cybersecurity firm Sekoia identified this vulnerability as part of an exploit chain used by the Russia-linked group APT29. Attackers utilized compromised websites and supply-chain attacks to deliver malicious JavaScript. This zero-click exploit chain targeted Safari and Chrome to deploy information-stealing malware, specifically harvesting browser cookies and sensitive device data from victims. ## Federal Compliance Requirements Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate identified vulnerabilities by specified deadlines. CISA has set the deadline for fixing CVE-2024-27834 for November 18, 2026. This directive aims to reduce the significant risks posed by known exploited vulnerabilities within federal infrastructure and prevent widespread unauthorized access. ## Broader Industry Recommendations While the directive specifically targets federal agencies, cybersecurity experts strongly recommend that private organizations also review the CISA catalog. Proactively addressing these vulnerabilities within private infrastructure is essential for maintaining a robust security posture. Organizations should prioritize patching these known flaws to mitigate the risk of targeted exploitation by sophisticated threat actors. ## Evolution of Modern Exploitation Modern Apple silicon architecture relies heavily on Pointer Authentication Codes to prevent control-flow hijacking. As security mitigations become more advanced, attackers are forced to develop complex bypass chains to achieve their objectives. The inclusion of this flaw in the CISA catalog highlights the ongoing cat-and-mouse game between hardware-level security and sophisticated exploit development. ## Sources covering this story - https://securityaffairs.com/202464/hacking/u-s-cisa-adds-apple-flaw-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._