74 openlast updated

HomeOctober 2026 patch cycleCVE-2024-27834 Apple PAC bypass: now in KEV

Patch nowEnterpriseEnd-user appsfrom 2026-10

CVE-2024-27834 Apple PAC bypass: now in KEV

Part of October 2026 patch cycle

Vendor
Apple
Products
iOS 16.7.8, iOS 17.5, iPadOS 16.7.8, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5
Published
Status
Open

Call: Patch now. On Nov 4, CISA added CVE-2024-27834 to KEV (federal due Nov 18). It is an improper-authentication / Pointer Authentication bypass on Apple platforms, CVSS 5.5. Apple fixed it in May 2024. CISA added it after reporting of active exploitation; The Hacker News cites Sekoia on activity attributed with moderate-to-high confidence to APT29 (Midnight Blizzard), chaining a WebKit bug with this PAC bypass to steal browser data from unpatched devices. If a Mac, iPhone, or iPad is still below the May 2024 builds below, it is overdue.

What breaks: Nothing. This is a security fix from 2024 that some fleets never took.

Fixed builds (Apple, May 2024):

  • iOS / iPadOS 17.5 or 16.7.8
  • macOS Sonoma 14.5
  • tvOS 17.5, watchOS 10.5
  • Safari 17.5

Who’s hit: Any Apple device still on a build before those releases. Newer OS trains that absorbed the fix are fine; the KEV hit is for the long tail that never moved.

What to do: Update through Settings / Software Update (or your MDM) to a fixed build or newer. CISA’s BOD 26-04 guidance applies for federal agencies; everyone else should treat KEV the same way and confirm the build, not just “updates are on.”

Sources: CISA KEV alert, The Hacker News, NVD, Apple iOS 17.5, Apple macOS Sonoma 14.5.

Sources

More from October 2026 patch cycle