On 4 November 2026 the US cyber security agency CISA added an Apple flaw to its list of vulnerabilities known to be exploited. It's CVE-2024-27834, and the 2024 in the name is the odd part. Apple released the fix on 13 May 2024, about two and a half years earlier.
So this isn't a new hole. The question for a business is which of its Apple devices are still running software from before that fix, and whether anybody knows.
First, does this apply to you?
This is a flaw in Apple's software, not in a website. Apple lists the fix for iPhones, iPads, Macs, Apple TVs and Apple Watches, so any of those running software from before May 2024 is where the question lands. If your business uses none of them, you can stop here.
Staff phones count, including personal ones used for work. Whose job they are is a separate question, and the last section comes back to it.
What the flaw is
Apple's advisories say the flaw is in WebKit, the part of Apple's software that handles web pages, and describe it as a way for an attacker who can already read and write in a program's memory to bypass Pointer Authentication. My plain version of that: Pointer Authentication is a protection that makes it harder for a flaw in a program to take control of it, and this flaw gets around it. Apple says the fix was improved checks.
The National Vulnerability Database scores it 5.5 out of 10, which is medium. CISA's own assessment in the record lists exploitation as active. A medium score next to an active listing is a reason to read the listing and not the score.
How it's being used
The CVE record links to a write-up by Sekoia, a security firm, published on 4 November, the same day as CISA's listing. I don't know whether CISA relied on it. Sekoia describes a campaign it found in mid-October that compromised or cloned several high-profile websites and used them to deliver exploit code to visitors. One of the three chains it recovered used this flaw, together with another, against iPhones running iOS 16.7, as the step that gets past Pointer Authentication. Sekoia says all three chains relied on flaws that had already been fixed, and that a user running an up-to-date operating system is safe from these attacks.
All of that is Sekoia's account and I haven't been able to check it independently. I'm not naming who Sekoia thinks is behind it, because that's their assessment and not something I can stand behind.
One detail doesn't sit neatly. Sekoia says the server it studied filtered for iOS 16.7 and 16.7.10, and that the chain should work from 16.0 to 17.4. Apple's advisory lists the fix in iOS 16.7.8, which is earlier than 16.7.10. Sekoia doesn't say whether any device on 16.7.10 was affected, and I can't reconcile the two from what's published. For an older iPhone, the version number is a reason to ask, not a guarantee.
A 2024 fix and a 2026 listing
On 13 May 2024 Apple released Safari 17.5, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, and described this flaw in their advisories. The entry for iOS 16.7.8 carries a later added date of 10 June 2024. On 4 November 2026 CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalogue with a due date of 18 November.
CISA's entry doesn't say how or against whom, and neither does Apple. Sekoia's report is the only account I've found, and it concerns one campaign.
How to check
You need the software version on each Apple device the business uses. Apple's own support pages show where to find it on each device, and whoever manages your devices can read the list off. One catch for Macs: on Monterey and Ventura, Apple's fix is in Safari 17.5, so the number that matters is Safari's and not the macOS number.
Apple's advisories list the fix in iOS 17.5 and iPadOS 17.5, in iOS 16.7.8 and iPadOS 16.7.8 for the iPhone 8, iPhone 8 Plus, iPhone X and three early iPads, in macOS Sonoma 14.5, in Safari 17.5 for Macs still on Monterey or Ventura, and in tvOS 17.5 and watchOS 10.5. Apple's advisories don't say in so many words that later versions have the fix. The CVE record's version ranges support reading it that way for Safari, macOS, tvOS, watchOS and iOS 17. For iOS 16 the record gives two overlapping ranges, so the reading is weaker there, which is the same group as the 16.7.10 question above.
Then sort each device into one of these, because what happens next is different for each.
On one of those versions or a later one.
Apple's fix is on, subject to the 16.7.10 question above for older iPhones.
Older, and Apple offers a newer version for it.
Raise it with whoever manages your devices.
Older, and it can't go any higher.
Apple's May 2024 advisories name the devices each fix is for, and my reading is that a device named in none of them isn't covered by this fix. What to do about it is a decision for whoever looks after your equipment.
You don't know what's in the building, or whose job it is.
That's the finding, and it's bigger than this flaw.
A fix going on doesn't tell you what happened before
A fix stops the flaw being used from that point on. It doesn't undo anything that happened earlier, and it doesn't tell you whether anything did. Nothing I've read says any particular device in a small business has been affected, and I'm not suggesting one has. If a device did sit on old software and you want to know more, working that out is a job for a security professional or your IT provider.
Who counts the devices?
CISA's required action says to apply the vendor's mitigations, or to discontinue use of the product if mitigations are unavailable. That's CISA's wording in its own catalogue, not advice for your business. What suits a small business with one old iPad is a decision for whoever looks after it, and I haven't seen your devices.
I build websites and not device fleets, so this isn't something I sell a fix for. My care plans cover websites, not devices, and that's a service I sell, which is why the link below goes there. The question is simple: could someone list every Apple device the business uses, with the version on each, by the end of the day?
Pages worth acting on
What to read next
Is your WordPress site patched against CVE-2026-119977?
WordPress fixed a flaw in its own upgrade process on 28 October, and CISA listed it as exploited on 3 November. The question worth asking is which version your site runs, and who confirmed it.
Read articleIs your Magento or Adobe Commerce store patched against CVE-2026-71362?
Adobe fixed this on 11 August and said at the time it knew of no exploitation. Six weeks later CISA listed it as actively exploited. The stores being hit now are the ones that never applied it.
Read articleIs your WordPress site patched against CVE-2026-87902?
WordPress patched a critical flaw on 22 September and CISA added it to the actively exploited list three days later. Many sites installed the fix on their own. Here's how to confirm yours did.
Read articleAbout this notice
Published 2026-11-05 and accurate to the sources linked above as at that date. Security situations move, so check the vendor's own advisory before you act on anything here.
This is general information about a published vulnerability. It's not advice about your site, which nobody can give without looking at it, and nothing here should be treated as a substitute for your own provider or a security professional.
Questions local business owners usually ask next
Not sure what your business runs?
A website is one of the things on that list. If you'd like someone to look at yours from the outside, send me the address and I'll tell you what I can see.