Apple WebKit vulnerability made it onto the CISA list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WebKit vulnerability affecting Apple devices to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026. The deadline given to U.S. federal agencies for the flaw tracked as CVE-2024-27834 expires on November 18, 2026. The vulnerability is not new; Apple released a fix in May 2024. The issue still remains on devices that never received the update.

CISA’s addition to the list means there is evidence the vulnerability has been used in real-world attacks. The agency does not detail which campaign the exploitation was identified in. In the catalog entry, the ransomware connection is marked as “unknown.”

Bypassing signature checks in WebKit

The vulnerability is in WebKit, the engine behind Safari. According to Apple’s advisory, if an attacker has already gained read and write access on the device, they can bypass Pointer Authentication protection. Pointer Authentication is a hardware-backed defense on Apple processors with the arm64e extension that verifies memory addresses with signatures; it makes it harder to hijack code flow. If this defense is neutralized, it becomes easier for the attacker to run their own code in the next stage. Apple credits Manfred Paul, who works with the Trend Micro Zero Day Initiative, with reporting the flaw.

NVD gives it a CVSS 3.1 score of 5.5, which is medium severity. The score stays relatively low because the attack first requires read-write access on the device. Vulnerabilities like this do not open the door remotely on their own; they are used as one link in a chain to get past the final defense in targeted attacks.

Which versions are affected

The vulnerability was fixed in iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, and watchOS 10.5. The fixes were rolled out in May 2024. On iPhone, iPad, Mac, Apple TV, and Apple Watch devices that received updates after that date, this vulnerability is no longer present.

The risk is on devices that never received the update or have gone a long time without being updated. For example, an iPhone still below iOS 16.7.8 or a Mac running a version earlier than macOS Sonoma 14.5 may still be affected. Test devices left on older versions in institutional inventories also fall into this group.

What to do

On iPhone and iPad, check the version under Settings > General > Software Update. On Mac, go to Apple menu > System Settings > General > Software Update; Safari updates come together with macOS updates. On devices whose update support has ended, using an up-to-date browser reduces the risk coming through WebKit.

CISA’s deadline applies only to U.S. federal agencies. But a vulnerability that makes it into KEV is also a sign for end users that it is “being actively exploited.” If you have an Apple device still on an older version, update it today.

Source: CISA KEV · NVD