The US Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple WebKit flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities list on 4 November 2026, meaning it has evidence the flaw has been used in real attacks. US federal civilian agencies must address it by 18 November 2026.

The flaw is an improper authentication weakness in Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS. It could let an attacker who already has read and write access in the browser bypass pointer authentication, one of the protections that makes iPhone exploits harder to complete. It scores 5.5 on the CVSS scale, but that figure alone understates its value as one link in a longer attack chain.

Fixed in May 2024 — the danger is old software

Apple fixed the flaw in May 2024, in Safari 17.5, iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Anyone running those versions or newer already has the fix. The risk sits with devices that have not been updated since.

The listing coincides with research from Sekoia on a campaign it calls Poisoned Source, which it links to the Russia-linked group APT29. According to that research, visitors to hacked websites, lookalike sites and pages carrying a tampered analytics script were served exploit chains matched to their phone and browser. On iPhones running iOS 16.7, one chain used CVE-2024-27834 to steal browser cookies. CISA's own entry does not name an attacker and lists known ransomware use as unknown.

What to do now

On every iPhone and iPad, go to Settings, General, Software Update and install the newest version the device can run. Update Safari on Macs the same way. If a device is too old to receive current software, it should not be used for work email, banking or company accounts.

Sources: CISA Known Exploited Vulnerabilities catalogue, entry for CVE-2024-27834 (added 4 November 2026); Carthage Electronics, November 4 2026 CVE Threat Brief, 4 November 2026; TSN Media, Apple KEV Vulnerability: CISA Lists 2024 WebKit Flaw, 4 November 2026.