pwned.coffeeOrder ticket · today's special · 4 Nov 2026

🔥 On the fly · exploited in the wildOld bug, newly exploited (KEV 2026-11-04)US federal deadline 2026-11-18Americano · 183°CmediumOrder up · fix available

Apple Multiple Products Improper Authentication Vulnerability

Apple Safari

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Added to CISA KEV on 2026-11-04 (federal deadline 2026-11-18).

Binds US federal agencies under CISA BOD 26-04.

Do this now

It is being exploited: upgrade Safari to 17.5, iOS and iPadOS to 17.5 or 16.7.8, macOS to 14.5, tvOS to 17.5 and watchOS to 10.5, matching your release line.

Who should check: teams running Apple

Fix it

Safari

Upgrade to Safari 17.5

iOS and iPadOS

On 16.xUpgrade to iOS and iPadOS 16.7.8
On 17.xUpgrade to iOS and iPadOS 17.5

macOS

Upgrade to macOS 14.5

tvOS

Upgrade to tvOS 17.5

watchOS

Upgrade to watchOS 10.5

Also affects (downstream advisories): wpewebkit wpe webkit. Check those vendors' own fixes.

First seen: 4 Nov 2026
Last update: 4 Nov 2026, 21:18 UTC
Fixed in: Safari 17.5
iOS and iPadOS 17.5
iOS and iPadOS 16.7.8
macOS 14.5
tvOS 17.5
watchOS 10.5
Identifiers: CVE-2024-27834
CVSS: 5.5
KEV deadline: 2026-11-18
Source: CISA KEV
On the menu as: Apple

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apple Multiple Products Improper Authentication Vulnerability
Severity: medium, exploited in the wild. Patch status: patched.
Affected: Apple Safari
Fixed in: Safari 17.5, iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS 14.5, tvOS 17.5, watchOS 10.5
Ids: CVE-2024-27834

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Added to CISA KEV on 2026-11-04 (federal deadline 2026-11-18).

## Steps
1. Search the repo, its CI and infra config for Apple Safari. If present, report the version in use and whether it's affected.
2. Fix by release line: Safari: 17.5. iOS and iPadOS: 17.5; 16.7.8. macOS: 14.5. tvOS: 17.5. watchOS: 10.5.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Safari | fixed | 17.5 | — |
| iOS and iPadOS | fixed | 17.5 | — |
| iOS and iPadOS | fixed | 16.7.8 | — |
| macOS | fixed | 14.5 | — |
| tvOS | fixed | 17.5 | — |
| watchOS | fixed | 10.5 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2024-27834") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2024-27834 https://support.apple.com/en-us/120896 https://support.apple.com/en-us/120898 https://support.apple.com/en-us/120901 https://support.apple.com/en-us/120902 https://support.apple.com/en-us/120903 https://support.apple.com/en-us/120905
https://pwned.coffee/i/apple-multiple-products-improper-authentication-vulnerab-cve-2024-27834

Timeline

4 Nov 2026, 21:18 UTC
Fix status: unknown → patched.
4 Nov 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2024-27834 added to CISA KEV on 2026-11-04, federal deadline 2026-11-18.” source
Fix by release line: Product Affected Fixed in Source
Safari before 17.5 17.5 CVE record (CNA) checked 4 Nov
iOS and iPadOS before 17.5 17.5 CVE record (CNA) checked 4 Nov
iOS and iPadOS before 16.7.8 16.7.8 CVE record (CNA) checked 4 Nov
macOS before 14.5 14.5 CVE record (CNA) checked 4 Nov
tvOS before 17.5 17.5 CVE record (CNA) checked 4 Nov
watchOS before 10.5 10.5 CVE record (CNA) checked 4 Nov
Score: CVSS 5.5 (medium). CVSS 3.1 5.5 (NVD) for CVE-2024-27834
Last checked: 4 Nov 2026, 22:17 UTC

Product	Affected	Fixed in	Source
Safari	before 17.5	17.5	CVE record (CNA) checked 4 Nov
iOS and iPadOS	before 17.5	17.5	CVE record (CNA) checked 4 Nov
iOS and iPadOS	before 16.7.8	16.7.8	CVE record (CNA) checked 4 Nov
macOS	before 14.5	14.5	CVE record (CNA) checked 4 Nov
tvOS	before 17.5	17.5	CVE record (CNA) checked 4 Nov
watchOS	before 10.5	10.5	CVE record (CNA) checked 4 Nov

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Totalone coffee