Apple pointer-authentication bypass added to KEV, the prerequisite matters
Old patch, fresh prioritization. CISA added Apple’s CVE-2024-27834 to KEV on November 4, 2026. Apple describes an attacker who already has arbitrary read and write capability potentially bypassing Pointer Authentication. Calling this a standalone, unauthenticated remote takeover would outrun the evidence.
What was fixed
Apple says improved checks addressed the issue. Its CNA record names Safari 17.5, iOS and iPadOS 16.7.8, iOS and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5 as fixes on their respective product branches. Apple’s Safari 17.5 bulletin dates that release to May 13, 2024 and covers macOS Monterey and Ventura. Those historic fixed releases are not a recommendation to stop updating there. Deploy a current supported release appropriate to the device.
What KEV changes
The November addition is an exploitation-prioritization signal, not proof the vulnerability was newly discovered or newly patched in November. CISA lists a November 18, 2026 due date. The retrieved Apple CNA container includes no numerical CVSS score, so none is attributed to Apple here.
Defensive response
Use device-management inventory to identify product family and installed OS or Safari version. Validate each against its own supported update track. Check that updates actually installed, including devices that missed management check-ins. A clean browser test does not establish that a device is patched, and version compliance does not establish that a device was never compromised.
No Kali probe is attached: an unauthenticated network scan would not establish this prerequisite or reliably inventory managed Apple updates. The sloth move is boring and effective: verify the fleet, close the gaps.
