CISA Adds Old Apple PAC Bypass to KEV After APT29 Reports

Patch first. If any Apple device you manage is still on a build older than the May 2024 releases, update it now. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, November 4, 2026, citing active exploitation, according to The Hacker News. Federal civilian agencies have until November 18, 2026 to apply fixes.

What changed

The flaw is an improper authentication issue that lets an attacker who already has arbitrary read and write capability bypass Pointer Authentication. The reported CVSS score is 5.5, which is why it is easy to wave off. Don’t. A bypass like this is a link in an exploit chain, and the severity score only measures the link.

Apple fixed it in May 2024 with improved checks. Fixed releases are iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The bug was first shown as a zero-day at Pwn2Own Vancouver in March 2024.

Why it is on the list now

The KEV addition follows a report from Sekoia that threat actors possibly linked to Russia exploited previously patched Safari and Chrome vulnerabilities to deliver malware that harvests browser and device data. Sekoia attributes the activity to APT29, also tracked as Cozy Bear and Midnight Blizzard, with “moderate to high confidence.”

The reported entry points are:

• compromised legitimate websites
• fake sites imitating popular ones
• a supply chain attack on the Plerdy SEO Tracker

Each serves malicious JavaScript that profiles the visitor’s device before deploying an information stealer. The report describes cookie theft as the payload’s goal. We are not covering the exploit mechanics, and you don’t need them to act.

What to do

1. Update Apple devices. Anything below the fixed releases above is exposed. Devices that cannot take iOS 17.5 or later should be on iOS 16.7.8 at minimum, and ideally replaced.
2. Update browsers. Safari 17.5 or later covers this flaw. Chrome should also be current, since the reported activity targeted both.
3. Check for Plerdy SEO Tracker. If your sites load it, review what script your pages are serving and contact the vendor. The source report does not give remediation details, so treat this as a check, not a confirmed compromise.
4. Rotate sessions for high-value users. If cookie theft is a concern for your team, force re-authentication on key accounts after patching.

Priority call

Patch first: unpatched Apple fleets, especially older iPhones kept on iOS 16. Deprioritize worrying about the 5.5 score. Exploitation is confirmed by CISA’s listing, and the old patch date means the fix has been available for roughly 18 months.

The Hacker News report also names a second CVE in the chain, but the ID is printed twice in its text, so we are not repeating it until a clean source confirms it.

See the Apple hub for related coverage, including Apple’s CoreGraphics fix for older iPhones and the CVE-2026-86950 targeted attacks.