{"id":3970,"date":"2026-11-05T08:28:29","date_gmt":"2026-11-05T16:28:29","guid":{"rendered":"https:\/\/cyber.mag212.com\/cisa-kev-apple-cve-2024-27834-apt29-pac-bypass\/"},"modified":"2026-11-05T08:28:29","modified_gmt":"2026-11-05T16:28:29","slug":"cisa-kev-apple-cve-2024-27834-apt29-pac-bypass","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cisa-kev-apple-cve-2024-27834-apt29-pac-bypass\/","title":{"rendered":"La CISA ajoute la vuln\u00e9rabilit\u00e9 Apple CVE-2024-27834 \u00e0 sa base de donn\u00e9es KEV\u00a0: contournement de l\u2019authentification par pointeur dans la cha\u00eene d\u2019exploitation d\u2019iPhone d\u2019APT29"},"content":{"rendered":"

On November 4, 2026, CISA added a two-and-a-half-year-old Apple flaw, CVE-2024-27834<\/strong>, to its Known Exploited Vulnerabilities (KEV) catalog. It was the only addition that day. The flaw is a WebKit bug that lets an attacker who has already gained memory read and write access bypass Pointer Authentication, one of the iPhone’s main defenses against exploitation. Apple fixed it in May 2024.<\/p>\n\n

The listing completes a picture. The same day, the security firm Sekoia published research attributing a mobile watering-hole campaign to the Russian group APT29 (covered in detail here<\/a>). CVE-2024-27834 is the pointer-authentication bypass in one of its iPhone exploit chains, and it was the only flaw in those chains not already in KEV. The practical message is the one Sekoia gives: every exploit in the campaign targets bugs that are already patched, so a device on a current operating system is safe.<\/p>\n\n

How we label claims: Confirmed<\/strong> = stated by the vendor, a CVE record or a government agency; Reported<\/strong> = stated by a named researcher or news outlet; MAG212 analysis<\/strong> = our assessment; Unknown<\/strong> = no source we checked has said. Updated November 5, 2026. By El Mostafa Ouchen.<\/em><\/p>\n\n

Key facts<\/h2>\n\n
Item<\/th>Detail<\/th>Status<\/th><\/tr><\/thead>
KEV listing<\/td>CVE-2024-27834 added November 4, 2026; federal due date November 18, 2026<\/td>Confirmed (CISA KEV data)<\/td><\/tr>
What it is<\/td>WebKit flaw: an attacker with arbitrary read and write capability may bypass Pointer Authentication<\/td>Confirmed (Apple)<\/td><\/tr>
Severity<\/td>CVSS 3.1 5.5 (CISA’s score; Apple published none)<\/td>Confirmed (CVE record)<\/td><\/tr>
Fixed<\/td>May 13, 2024: iOS and iPadOS 17.5 and 16.7.8 (16.7.8 entry added June 10, 2024), Safari 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5<\/td>Confirmed (Apple)<\/td><\/tr>
Discovered by<\/td>Manfred Paul, working with Trend Micro’s Zero Day Initiative; used at Pwn2Own Vancouver 2024<\/td>Confirmed (Apple credit); Pwn2Own link Reported<\/td><\/tr>
Exploited by<\/td>APT29, per Sekoia, with moderate to high confidence<\/td>Reported (Sekoia)<\/td><\/tr>
Ransomware use<\/td>Unknown, per CISA<\/td>Confirmed (CISA KEV data)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Why a medium-severity bug matters<\/h2>\n\n

A score of 5.5 looks modest, and on its own the flaw does little. It needs an attacker who already has read and write access to memory. But modern iPhones sign key pointers in hardware using Pointer Authentication Codes (PAC). Even an attacker who can write to memory can’t simply overwrite a pointer to redirect the program without a valid signature. A PAC bypass removes that barrier, which is why it shows up as a crucial link in exploit chains. Chained after a browser bug that provides memory access, it turns a crash into code execution.<\/p>\n\n

The bug has a public history. At Pwn2Own Vancouver in March 2024, Manfred Paul compromised Safari using an integer underflow plus a PAC bypass. Apple credits CVE-2024-27834 to him through the Zero Day Initiative, and BleepingComputer identified it as that contest bug when Apple shipped the fix in May 2024. Status: Pwn2Own exploit Confirmed (ZDI); CVE link Reported (BleepingComputer).<\/em><\/p>\n\n

How it fits the APT29 campaign<\/h2>\n\n

Sekoia’s report, “Poisoned Source”, describes watering-hole attacks: legitimate websites were compromised, or look-alike sites set up, so that visitors’ phones were served exploits. The sites included a Ukrainian gas company, a US chemical trade association, and European political and Bulgarian military-related sites. A supply-chain compromise of an SEO tracking script, Plerdy SEO Tracker, spread the malicious code further between August 27 and September 3, 2026. Sekoia attributes the campaign to APT29, or at least one of its subgroups, with moderate to high confidence.<\/p>\n\n

Sekoia describes three exploit chains:<\/p>\n\n

Chain<\/th>Target<\/th>Vulnerabilities<\/th>Payload<\/th><\/tr><\/thead>
Class A<\/td>iOS 16.7 (Sekoia says it should work on 16.0 to 17.4)<\/td>CVE-2025-43529 (WebKit code execution), then CVE-2024-27834 (PAC bypass)<\/td>Cookie stealer<\/td><\/tr>
Class B<\/td>iOS 18.5<\/td>CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520<\/td>Full data harvester<\/td><\/tr>
Class C<\/td>Chrome 139\u2013145 (except 143) on Android<\/td>CVE-2026-3910 (renderer), CVE-2025-27038 (Adreno GPU driver)<\/td>Android payload (see Sekoia report)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Every other CVE in these chains was already in CISA’s KEV catalog, some since 2025. CVE-2024-27834 was the missing piece, and it is now listed. Status: chains Reported (Sekoia); KEV dates Confirmed (CISA KEV data).<\/em><\/p>\n\n

Sekoia reports that the Class A delivery server filtered for iOS 16.7 and 16.7.10. MAG212 analysis:<\/strong> Apple fixed this flaw in iOS 16.7.8, so the filter’s purpose is unclear. Do not assume a device on any iOS 16.7 build is safe from the campaign as a whole. Patch to the newest version the device supports.<\/p>\n\n

Who needs to act<\/h2>\n\n

Under CISA’s directive, US federal civilian agencies must remediate by November 18, 2026. For everyone else, KEV is a strong signal of real-world use. MAG212 analysis:<\/strong> the devices at risk are those that stopped updating, typically older iPhones and iPads kept on iOS 16 or early iOS 17, shared devices nobody owns, and phones with updates postponed. These attacks are delivered through ordinary-looking websites, so people who never click a suspicious link can still be exposed.<\/p>\n\n

What to do, in order<\/h2>\n\n
  1. Set a minimum OS version<\/strong> in your MDM for iOS, iPadOS and macOS, and block or limit access to email and corporate apps for devices below it.<\/li>
  2. Update to the latest version each device supports.<\/strong> iOS 17.5 or iOS 16.7.8 fixes this CVE, but the other chain bugs need later releases, so “current” is the target.<\/li>
  3. Replace devices that can’t run a supported OS.<\/strong> Devices stuck on iOS 16 are the ones Sekoia’s Class A chain is built for.<\/li>
  4. Don’t forget Safari on older Macs<\/strong> (Safari 17.5 or later on Monterey and Ventura), Apple TV and Apple Watch.<\/li>
  5. Hunt in DNS and proxy logs<\/strong> for the indicators Sekoia published, including static.flux-telemetry[.]com<\/code>, edge-ord.clouds-stacks[.]com<\/code> and ad.starx-net[.]com<\/code>.<\/li>
  6. Check your own websites<\/strong> and partners’ sites for scripts loaded from a.plerdy[.]com<\/code> during the compromise window, and for third-party scripts you no longer need.<\/li><\/ol>\n\n

    How to check an Apple device<\/h2>\n\n

    On iPhone or iPad: Settings<\/em>, then General<\/em>, then About<\/em>, and read iOS Version<\/em>. On a Mac, this read-only Terminal command prints the macOS version (no admin rights needed; not tested by MAG212):<\/p>\n\n

    sw_vers -productVersion<\/code><\/pre>\n\n
    In MDM consoles, filter the device inventory by OS version below your minimum to find stragglers.<\/p>\n\n
    Frequently asked questions<\/h2>\n\n
    Is my up-to-date iPhone at risk?<\/h3>\n\n
    Not from this campaign, according to Sekoia: all three chains use vulnerabilities that are already patched.<\/p>\n\n
    Why is a 2024 bug being listed now?<\/h3>\n\n
    KEV lists flaws once there is evidence of exploitation. CISA doesn’t say what evidence it used, but the listing came the same day as Sekoia’s report, which CISA’s record cites as a reference.<\/p>\n\n
    Is this the same as the 2024 Mongolia watering-hole attacks?<\/h3>\n\n
    No. Google’s Threat Analysis Group reported a separate APT29-linked watering-hole campaign against Mongolian sites in 2024. Sekoia compares the two and suggests the exploits in both may have come from third parties.<\/p>\n\n
    \n\n
    Read today’s full MAG212 CYBER Daily (free) \u2192<\/a><\/div>
    Subscribe free<\/a><\/div><\/div>\n\n
    Sources<\/h2>\n\n