Apple Multiple Products Improper Authentication Vulnerability
Apple — Multiple Products
- Added to KEV catalog
- 4 November 2026
- Federal remediation due date
- 18 November 2026
- Weakness classification (CWE)
- CWE-287
AI Breakdown
What it is
Apple operating systems and Safari contain an improper authentication vulnerability affecting pointer authentication. An attacker who already possesses arbitrary read and write capabilities can exploit this weakness to bypass standard memory protections. This flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, tvOS, watchOS, and the Safari browser.
Why it matters
This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Although its use in ransomware campaigns is currently unknown, bypassing pointer authentication weakens essential operating system defenses. Leaving devices unpatched exposes organization-owned Apple endpoints to deeper compromise.
Recommended action
Apply the official vendor security updates immediately, including Safari 17.5, iOS and iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. IT teams should evaluate asset exposure and align with risk-based patching guidelines such as CISA BOD 26-04. If updates cannot be applied according to vendor instructions, consider discontinuing use of the affected product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://support.apple.com/en-us/120896 ; https://support.apple.com/en-us/120898 ; https://support.apple.com/en-us/120901 ; https://support.apple.com/en-us/120902 ; https://support.apple.com/en-us/120903 ; https://support.apple.com/en-us/120905 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2024-27834
NVD Technical Description
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
More Apple Vulnerabilities
Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple macOS Improper Authentication Vulnerability
Apple Multiple Products Classic Buffer Overflow Vulnerability
Apple Multiple Products Improper Locking Vulnerability
Apple Multiple Products Buffer Overflow Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services