On November 4, 2026, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog. The entry is one line long: "Apple Multiple Products Improper Authentication Vulnerability." Behind that line is a useful story about how real-world exploitation actually works, because this is not a fresh zero-day. Apple shipped the fix on May 13, 2024, almost eighteen months ago, in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5 (with iOS 16.7.8 for older devices).

What the bug is

CVE-2024-27834 is an improper authentication issue in WebKit that lets an attacker who already has arbitrary read and write capability bypass Pointer Authentication, the hardware-backed integrity check that is supposed to stop exactly this kind of memory corruption from becoming code execution. Apple's advisory credits Manfred Paul, working with Trend Micro's Zero Day Initiative; the bug was demonstrated as a zero-day at Pwn2Own Vancouver in March 2024. Its CVSS score is 5.5, which reads as "medium," and on its own it is: you still need another bug to get the read/write primitives first.

That is precisely the point. Exploit chains are built out of links, and a medium-severity link is still a link.

Why it is in the KEV now

The KEV addition follows reporting by Sekoia researchers Amaury-Jacques Garcon and Felix Aime on a campaign they call Poisoned Source, discovered in mid-October 2026 and attributed with moderate to high confidence to APT29, the group tied to Russia's Foreign Intelligence Service. The campaign turns websites into silent exploit delivery systems for iPhones and Android devices, using three infection vectors:

  • Compromised legitimate websites with injected malicious JavaScript. Reported victims include a major U.S. chemical industry trade association, a far-right European political party and a Bulgarian military-related website.
  • Lookalike domains masquerading as high-profile sites in the U.S., Ukraine, the Czech Republic and Bulgaria, including one posing as an official U.S. anniversary celebration site.
  • A supply chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics service. Between August 27 and September 3, 2026, attackers injected malicious code into a JavaScript file (a.plerdy[.]com/public/js/click/main.js) that Plerdy's customers load on their own sites, which multiplied the campaign's reach without touching each site individually.

The injected script profiles the visitor's device and browser, then the delivery infrastructure picks an exploit chain. Sekoia describes three classes. Class A hits iOS 16.7 devices by combining a WebKit remote code execution flaw (CVE-2025-43529) with CVE-2024-27834, the PAC bypass, to run JavaScript malware that steals browser cookies. Class B goes after iOS 18.5 with a longer DarkSword chain of five CVEs and aims at full device data: SMS and iMessages, mail databases, WhatsApp and Telegram data, iCloud Keychain and Wi-Fi passwords, contacts, call history, photos, Health, Calendar, Notes and iCloud Drive content. Class C targets Android Chrome versions 139 through 145 (skipping 143 for unknown reasons) and drops a payload Sekoia calls AndroSnitch to steal Chrome data and Wi-Fi passwords. Curiously, the Android chain aborts if the device identifies as a Samsung Galaxy S25 Ultra. Stolen data goes to a telemetry endpoint at ad.starx-net[.]com:8881.

None of this requires the victim to tap anything. These are watering hole attacks: opening the wrong page on an unpatched device is enough.

The real lesson: n-days are the workhorse

Every vulnerability in these chains was already patched when the campaign was running. CVE-2024-27834 had a fix for nearly a year and a half. That is the normal economics of exploitation now, and Sekoia says so explicitly: packaged n-day exploit chains, originally built by commercial surveillance vendors and reused by state actors, lower the cost and the skill threshold of advanced mobile exploitation. The attacker does not need a zero-day if enough of the world's phones are running an eighteen-month-old OS.

There is also a severity lesson. A CVSS 5.5 bug that "only" bypasses a mitigation looks unimpressive in a triage queue. Chained behind an RCE, it is the difference between a crashed browser and stolen cookies. Severity scores describe a bug in isolation; attackers use bugs in combination.

Two honest caveats. Attribution to APT29 is Sekoia's assessment at moderate to high confidence, not a proven fact, and Sekoia itself says it is unclear whether the campaign meant to hit specific high-value visitors or simply compromise as many unpatched devices as possible and sort the data later.

What to do

The boring advice is the correct advice, and for once it is fully within reach:

  • Update your iPhone, iPad, Mac and Android devices to the current OS, and Chrome to the current version. Turn on automatic updates so you are not the softest target in a watering hole.
  • Restart your phone occasionally. These chains generally do not establish persistence, and a reboot wipes the implant from memory.
  • If you are a genuinely high-risk user (journalist, activist, official), consider Apple's Lockdown Mode, which is built for exactly this class of threat.
  • If you run a website, review which third-party analytics and tag scripts you load. The Plerdy compromise shows that your visitors' security now depends on your vendors' security. U.S. federal agencies have until November 18, 2026 to remediate CVE-2024-27834 under CISA's Binding Operational Directive 26-04; everyone else has the same deadline in practice, set by the attackers rather than by CISA.

A patch is only a fix when it is installed. Eighteen months is a long time to leave a door unlocked, and someone eventually walks through it.

Sources: CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (Nov 4, 2026); Apple, "About the security content of iOS 17.5 and iPadOS 17.5" (May 13, 2024); Sekoia's Poisoned Source research as reported by The Hacker News (Nov 4-5, 2026) and BleepingComputer (Nov 4, 2026).