CISA Adds Apple CVE-2024-27834 to KEV After APT29-Linked Attacks: What IT Teams Should Patch

The addition is a reminder that old, fixed bugs stay useful to attackers. Sekoia, via The Hacker News, linked the campaign to the Russian state-sponsored group APT29, and a supply chain compromise of a web analytics script helped spread it.

This post summarizes what is confirmed, what is attributed by researchers and what IT teams should do. Facts come from CISA, The Hacker News and Apple, with dates stated.

What happened

CISA added Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, 2026, citing evidence of active exploitation. The flaw is a pointer authentication bypass that Apple fixed in May 2024, so the risk falls on devices that never updated.

CISA labeled the entry an Apple multiple products improper authentication vulnerability and urged all organizations, not only federal agencies, to prioritize remediation of catalog entries (CISA alert, November 4, 2026).

The Hacker News reported on November 5, 2026 that security firm Sekoia tied the activity to APT29, also tracked as Cozy Bear or Midnight Blizzard, with moderate to high confidence. Sekoia described three delivery routes: compromised legitimate sites, lookalike domains and a supply chain compromise of the Plerdy SEO tracker script. The payload is an information stealer aimed at browser cookies and device data (The Hacker News, November 5, 2026). CISA and Apple have not attributed the activity themselves.

Which Apple versions are fixed

Apple shipped the fix on May 13, 2024, in iOS 17.5 and iPadOS 17.5, with iOS 16.7.8 and iPadOS 16.7.8 for older devices, plus macOS Sonoma 14.5 and Safari 17.5. Any device below those releases remains exposed.

Apple lists the May 2024 releases on its security releases page. According to The Hacker News, the full fixed set also covers tvOS 17.5 and watchOS 10.5. Reports say the federal remediation deadline is November 18, 2026.

The bug was first shown as a zero-day at the Pwn2Own Vancouver contest in March 2024. Its CVSS score is 5.5, which is medium, but exploitation in a chain turns a moderate score into a practical attack path.

Why it matters for B2B teams

A patched flaw is still dangerous when fleets lag. Attackers reuse old, fixed bugs because many organizations leave personal phones, contractor laptops and unmanaged tablets behind, and a compromised analytics script can reach employees through ordinary web browsing.

Two lessons stand out. First, the Plerdy case shows how a third-party script on a trusted site can become the delivery channel, so marketing tags deserve the same review as code dependencies. Second, a stolen browser session cookie can bypass multi-factor authentication for SaaS apps, so a phone compromise can become a cloud account compromise.

What IT teams should do now

Inventory Apple devices below the fixed releases, push updates through device management, review third-party scripts and shorten session lifetimes for sensitive apps. Treat KEV additions as a trigger to check for stale patch levels, even for bugs fixed years ago.

• Report OS versions across iPhones, iPads and Macs, and flag anything older than iOS 17.5 or macOS Sonoma 14.5.
• Enforce updates through your mobile device management or unified endpoint management platform.
• Audit tags and third-party scripts, including SEO and analytics trackers, and remove unused ones.
• Revoke and reissue sessions for users on unpatched devices, and watch for unusual logins.
• Add KEV feed checks to your vulnerability management and patch management routines.

Device vendors such as Apple publish fixes, but your visibility depends on your own inventory and enforcement.

Related SaaSPodium resources

Related categories include mobile device management, patch management and vulnerability management software. Together they cover inventory, enforcement and risk prioritization, which are the three capabilities this incident tests.

See our recent coverage of the WordPress core CISA KEV update and the Cisco ASA and FTD exploited flaw for similar patch-now guidance.

Frequently Asked Questions

Is CVE-2024-27834 a new vulnerability?
No. Apple fixed it in May 2024. CISA added it to the KEV catalog on November 4, 2026 because attackers are exploiting it against devices that were never updated.

Which Apple devices are protected against CVE-2024-27834?
Devices running iOS or iPadOS 17.5 or later, iOS 16.7.8, macOS Sonoma 14.5 or later with Safari 17.5, or equivalent fixed releases are protected. Check the Apple security releases page for your exact model.

How can a business detect devices that are still vulnerable?
Use mobile device management or endpoint inventory reports to list OS versions, then compare them to the fixed releases. Treat devices you cannot see as unmanaged risk and restrict their access to company apps.