Our automated tracking framework flagged that CISA added CVE-2024-27834 (Apple Multiple Products) to the Known Exploited Vulnerabilities (KEV) catalog on November 5, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2024-27834 by November 18, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2024-27834 |
| Vendor / product | Apple Multiple Products |
| Vulnerability | Apple Multiple Products Improper Authentication Vulnerability |
| CVSS base score | 5.5 |
| Added to KEV | November 4, 2026 |
| Days public before listing (NVD → KEV lag) | 904 |
| Federal patch deadline | November 18, 2026 |
| Known ransomware use | No |
How This Compares to Apple’s Track Record
This one was public for 904 days before CISA confirmed exploitation — longer than Apple’s 56-day median, a vulnerability that sat exploitable in the open.
| Apple in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 96 |
| Median lag (public → KEV listing) | 56 days |
| 0-day rate (exploited at or before disclosure) | 25% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1767 tracked KEV entries is 232 days — Apple’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Apple KEV Additions
The most recent Apple vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-86950 | Multiple Products | September 29, 2026 | 1 | No |
| CVE-2026-65400 | macOS | August 18, 2026 | 12 | No |
| CVE-2025-31277 | Multiple Products | March 20, 2026 | 233 | No |
| CVE-2025-43520 | Multiple Products | March 20, 2026 | 98 | No |
| CVE-2025-43510 | Multiple Products | March 20, 2026 | 98 | No |
What This Means for Defenders
CISA has added CVE-2024-27834, an Improper Authentication vulnerability in Apple Multiple Products, to its Known Exploited Vulnerabilities (KEV) catalog. It has a CVSS base score of 5.5. Federal agencies must patch by November 18, 2026; all organizations should prioritize patching before that deadline. CVE-2024-27834 was public for 904 days before its KEV listing on November 4, 2026.
This prolonged period between disclosure and KEV listing suggests exploitation may have been ongoing for a significant time. While there’s no known ransomware use, improper authentication can lead to unauthorized access. If immediate patching isn’t possible, restrict network access to vulnerable systems, strengthen access controls, and use multi-factor authentication. Enhance monitoring for unusual activity and conduct regular security audits to detect and respond to potential exploitation.
Related Coverage
- Apple’s CVE-2026-65400 Was Exploited in 12 Days — Faster Than Its 56-Day Median (August 2026)
- Apple’s CVE-2026-86950 Was Exploited in 1 Days — Faster Than Its 56-Day Median (September 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
