MAG212 CYBER ORIGINAL ARTICLE

CISA Adds Apple CVE-2024-27834 to KEV: The Pointer Authentication Bypass in APT29’s iPhone Exploit Chain

November 5, 2026 · El Mostafa Ouchen

On November 4, 2026, CISA added a two-and-a-half-year-old Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities (KEV) catalog. It was the only addition that day. The flaw is a WebKit bug that lets an attacker who has already gained memory read and write access bypass Pointer Authentication, one of the iPhone’s main defenses against exploitation. Apple fixed it in May 2024.

The listing completes a picture. The same day, the security firm Sekoia published research attributing a mobile watering-hole campaign to the Russian group APT29 (covered in detail here). CVE-2024-27834 is the pointer-authentication bypass in one of its iPhone exploit chains, and it was the only flaw in those chains not already in KEV. The practical message is the one Sekoia gives: every exploit in the campaign targets bugs that are already patched, so a device on a current operating system is safe.

How we label claims: Confirmed = stated by the vendor, a CVE record or a government agency; Reported = stated by a named researcher or news outlet; MAG212 analysis = our assessment; Unknown = no source we checked has said. Updated November 5, 2026. By El Mostafa Ouchen.

Key facts

Item	Detail	Status
KEV listing	CVE-2024-27834 added November 4, 2026; federal due date November 18, 2026	Confirmed (CISA KEV data)
What it is	WebKit flaw: an attacker with arbitrary read and write capability may bypass Pointer Authentication	Confirmed (Apple)
Severity	CVSS 3.1 5.5 (CISA’s score; Apple published none)	Confirmed (CVE record)
Fixed	May 13, 2024: iOS and iPadOS 17.5 and 16.7.8 (16.7.8 entry added June 10, 2024), Safari 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5	Confirmed (Apple)
Discovered by	Manfred Paul, working with Trend Micro’s Zero Day Initiative; used at Pwn2Own Vancouver 2024	Confirmed (Apple credit); Pwn2Own link Reported
Exploited by	APT29, per Sekoia, with moderate to high confidence	Reported (Sekoia)
Ransomware use	Unknown, per CISA	Confirmed (CISA KEV data)

Why a medium-severity bug matters

A score of 5.5 looks modest, and on its own the flaw does little. It needs an attacker who already has read and write access to memory. But modern iPhones sign key pointers in hardware using Pointer Authentication Codes (PAC). Even an attacker who can write to memory can’t simply overwrite a pointer to redirect the program without a valid signature. A PAC bypass removes that barrier, which is why it shows up as a crucial link in exploit chains. Chained after a browser bug that provides memory access, it turns a crash into code execution.

The bug has a public history. At Pwn2Own Vancouver in March 2024, Manfred Paul compromised Safari using an integer underflow plus a PAC bypass. Apple credits CVE-2024-27834 to him through the Zero Day Initiative, and BleepingComputer identified it as that contest bug when Apple shipped the fix in May 2024. Status: Pwn2Own exploit Confirmed (ZDI); CVE link Reported (BleepingComputer).

How it fits the APT29 campaign

Sekoia’s report, “Poisoned Source”, describes watering-hole attacks: legitimate websites were compromised, or look-alike sites set up, so that visitors’ phones were served exploits. The sites included a Ukrainian gas company, a US chemical trade association, and European political and Bulgarian military-related sites. A supply-chain compromise of an SEO tracking script, Plerdy SEO Tracker, spread the malicious code further between August 27 and September 3, 2026. Sekoia attributes the campaign to APT29, or at least one of its subgroups, with moderate to high confidence.

Sekoia describes three exploit chains:

Chain	Target	Vulnerabilities	Payload
Class A	iOS 16.7 (Sekoia says it should work on 16.0 to 17.4)	CVE-2025-43529 (WebKit code execution), then CVE-2024-27834 (PAC bypass)	Cookie stealer
Class B	iOS 18.5	CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520	Full data harvester
Class C	Chrome 139–145 (except 143) on Android	CVE-2026-3910 (renderer), CVE-2025-27038 (Adreno GPU driver)	Android payload (see Sekoia report)

Every other CVE in these chains was already in CISA’s KEV catalog, some since 2025. CVE-2024-27834 was the missing piece, and it is now listed. Status: chains Reported (Sekoia); KEV dates Confirmed (CISA KEV data).

Sekoia reports that the Class A delivery server filtered for iOS 16.7 and 16.7.10. MAG212 analysis: Apple fixed this flaw in iOS 16.7.8, so the filter’s purpose is unclear. Do not assume a device on any iOS 16.7 build is safe from the campaign as a whole. Patch to the newest version the device supports.

Who needs to act

Under CISA’s directive, US federal civilian agencies must remediate by November 18, 2026. For everyone else, KEV is a strong signal of real-world use. MAG212 analysis: the devices at risk are those that stopped updating, typically older iPhones and iPads kept on iOS 16 or early iOS 17, shared devices nobody owns, and phones with updates postponed. These attacks are delivered through ordinary-looking websites, so people who never click a suspicious link can still be exposed.

What to do, in order

Set a minimum OS version in your MDM for iOS, iPadOS and macOS, and block or limit access to email and corporate apps for devices below it.
Update to the latest version each device supports. iOS 17.5 or iOS 16.7.8 fixes this CVE, but the other chain bugs need later releases, so “current” is the target.
Replace devices that can’t run a supported OS. Devices stuck on iOS 16 are the ones Sekoia’s Class A chain is built for.
Don’t forget Safari on older Macs (Safari 17.5 or later on Monterey and Ventura), Apple TV and Apple Watch.
Hunt in DNS and proxy logs for the indicators Sekoia published, including static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com and ad.starx-net[.]com.
Check your own websites and partners’ sites for scripts loaded from a.plerdy[.]com during the compromise window, and for third-party scripts you no longer need.

How to check an Apple device

On iPhone or iPad: Settings, then General, then About, and read iOS Version. On a Mac, this read-only Terminal command prints the macOS version (no admin rights needed; not tested by MAG212):

sw_vers -productVersion

In MDM consoles, filter the device inventory by OS version below your minimum to find stragglers.

Frequently asked questions

Is my up-to-date iPhone at risk?

Not from this campaign, according to Sekoia: all three chains use vulnerabilities that are already patched.

Why is a 2024 bug being listed now?

KEV lists flaws once there is evidence of exploitation. CISA doesn’t say what evidence it used, but the listing came the same day as Sekoia’s report, which CISA’s record cites as a reference.

Is this the same as the 2024 Mongolia watering-hole attacks?

No. Google’s Threat Analysis Group reported a separate APT29-linked watering-hole campaign against Mongolian sites in 2024. Sekoia compares the two and suggests the exploits in both may have come from third parties.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free