CISA adds CVE-2024-27834 to KEV; deadline applies to FCEB agencies

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) Catalog on November 4, 2026, citing evidence of active exploitation. The catalog’s November 18 remediation deadline applies to Federal Civilian Executive Branch (FCEB) agencies under BOD 26-04. CISA advises other organizations to prioritize KEV-listed vulnerabilities through risk-based management, rather than setting that deadline for them. (CISA’s alert; KEV Catalog)

The November 18 deadline applies to FCEB agencies; other organizations are urged to prioritize vulnerabilities based on risk.

What CVE-2024-27834 does

The National Vulnerability Database (NVD) describes CVE-2024-27834 as an improper-authentication flaw that may let an attacker bypass Pointer Authentication after gaining arbitrary read and write capability. Pointer Authentication is a security mechanism used to protect pointers in code. NVD rates the vulnerability 5.5, Medium, on CVSS 3.1. (NVD’s CVE record)

NVD lists these Apple releases as fixes:

What Sekoia reported about the iOS chain

Sekoia’s campaign analysis, reported on November 4, described a “Class A” chain targeting iOS 16.7. It paired CVE-2024-27834 with CVE-2025-43529 to deliver JavaScript malware for browser-cookie theft. In that account, CVE-2024-27834 is the Pointer Authentication bypass; the reported chain uses two vulnerabilities, rather than describing this flaw as the route into a device.