# CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability

- Exploited (CISA KEV): yes, added 2026-11-04
- Published: 2024-05-13
- CVSS: 8.1 HIGH (v3.1)
- EPSS: 1.4% (73th percentile)
- CWE: CWE-287

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| Vercel | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

166 posts seen since 2026-11-04.

- x 2026-11-05: Hackers are exploiting an Apple vulnerability patched in May 2024.  CISA has added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog.  The attacks, attributed to Russia-linked APT29, reportedly use compromised websites and malicious JavaScript to bypass Apple's (https://x.com/itsMikeKipruto/status/2118216171325460988)
- mastodon 2026-11-05: Do you run Apple Multiple Products? CISA lists CVE-2024-27834 as exploited (added 4 Nov 2026). Can it reach you? Only with access to the machine itself. It needs a user account, and nobody has to click. CVSS 5.5. Plain-English breakdown: https:// xploitdigest.com/kev/CVE-2024- 2… (https://infosec.exchange/@xploitdigest_kev/117565233845683973)
- mastodon 2026-11-04: Added to CISA's Known Exploited Vulnerabilities catalog: CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability CVSS 5.5 (Medium). EPSS 0.6%. US federal agencies must remediate by 2026-11-18. Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain a… (https://infosec.exchange/@overflo_ws/117560143935573487)
- x 2026-11-04: 🛡️We added improper authentication vulnerability CVE-2024-27834 affecting multiple Apple products to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org. #Cybersecurity #InfoSec https://t.co/IggJtpxDt6 (https://x.com/CISACyber/status/2118083150345597189)
- mastodon 2026-11-06: 🛡️ The CVEs that mattered · Thursday 5 November 1. CVE-2023-20198 · Critical 10.0 · exploited — Cisco IOS XE Web UI 2. CVE-2024-27834 · Medium 5.5 · exploited — Apple Multiple Products 3. CVE-2026-83844 · High 8.1 — Microsoft Paint https:// ax-news.com/cve # CVE # infosec (https://infosec.exchange/@axnews/117568333470421059)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-27834 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-27834