Apple CVE-2024-27834 Added to CISA KEV After APT29 Attacks

CISA added Apple CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, 2026, with a federal patch deadline of November 18. The flaw is a Pointer Authentication bypass that Apple fixed in May 2024. It was added after Sekoia reported an APT29-linked watering hole campaign that used it, with other already patched bugs, to steal cookies from iPhones still on iOS 16. If you have Apple devices that never took the 2024 updates, find them and update or retire them this week.

What happened

On November 4, Sekoia's Threat Detection and Research team published "Poisoned Source", a report on a watering hole campaign it uncovered in mid-October 2026. The operators sent website visitors to an exploit delivery server through three routes:

JavaScript injected into legitimate websites, including a Ukrainian gas production company, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related site.
Lookalike domains that acted as reverse proxies for real sites and injected the same script on the fly. Sekoia named two: one impersonating the America250 anniversary site and one impersonating the Raffles London at The OWO hotel.
A one-week compromise of the Plerdy SEO tracker, a Ukrainian web analytics service loaded by thousands of mostly Ukrainian websites. Between August 27 and September 3, 2026, the tracker's main script also loaded the attackers' fingerprinting code.

The fingerprinting script profiled each visitor's device and browser. The delivery server then returned an exploit chain matched to that platform, with no click required. Sekoia retrieved three chains. The iOS 16.7 chain combines the WebKit bug CVE-2025-43529 with CVE-2024-27834 and steals cookies. A second iOS chain targets iOS 18.5 and is based on DarkSword, an exploit kit Sekoia suspects was built by a commercial surveillance vendor; it collects messages, Keychain items, photos, location data and more. The Android chain targets Chrome 139 through 145, excluding 143, and steals Chrome cookies, saved logins and Wi-Fi passwords.

Sekoia assesses with moderate to high confidence that the campaign is APT29, the Russian intrusion set widely attributed to the SVR. It also believes APT29 obtained the exploits from a third party. None of the payloads set up persistence.

CISA's KEV entry followed. It lists CVE-2024-27834 as an Apple Multiple Products improper authentication vulnerability (CWE-287), due November 18, with ransomware use marked Unknown.

Who is affected

Every bug in the three chains was fixed before the campaign began. Sekoia states that a user running an up to date operating system is safe from these attacks. The exposure is the long tail of devices that stopped updating.

For CVE-2024-27834 specifically, Apple's fixed versions are:

iOS 16.7.8 and iPadOS 16.7.8
iOS 17.5 and iPadOS 17.5
macOS Sonoma 14.5
Safari 17.5
tvOS 17.5 and watchOS 10.5

Sekoia notes the iOS 16 chain should work from iOS 16.0 through 17.4, even though the delivery server only served it to iOS 16.7 builds. One detail matters for anyone holding iOS 16 devices: the CVE record for CVE-2025-43529, the first stage of that chain, lists fixes in iOS 18.7.3 and iOS 26.2 only. Patching to 16.7.8 or later removes the Pointer Authentication bypass, but those devices still run an old WebKit. Treat them as unsupported.

On Android, the CVE record for CVE-2026-3910 lists Chrome before 146.0.7680.75 as affected, and CISA added that bug to KEV in March 2026. Any Android phone whose Chrome has not updated since early 2026 sits inside the targeted range.

The visitors Sekoia describes were reaching military, defense equipment, energy and government-adjacent sites, mostly Ukrainian, plus targets in the US, Czech Republic and Bulgaria. Because the Plerdy compromise hit every site using the tracker, ordinary visitors to unrelated sites were exposed too.

How Apple CVE-2024-27834 fits the exploit chain

CVE-2024-27834 is not a remote entry point on its own. Apple's advisory describes it as letting an attacker who already has arbitrary read and write capability bypass Pointer Authentication. Manfred Paul demonstrated it at Pwn2Own Vancouver in March 2024 through Trend Micro's Zero Day Initiative. The CVE record carries a CVSS 3.1 score of 5.5, which undersells its role: in a browser chain, it is the step that turns memory corruption into code execution on Apple silicon. For background on why that step matters, see what Pointer Authentication is and what a PAC bypass does.

The campaign shows a pattern worth planning around. The exploits were n-days, apparently bought or borrowed, and delivered from widely visited sites rather than phishing links. Old bugs stay useful as long as old devices stay online, and a low CVSS score did not stop one from earning a KEV entry two and a half years after the patch.

The stolen data is also the real risk to your organization. Sekoia notes that stolen cookies may let the operators reuse authenticated sessions, including webmail. A patched phone does not invalidate a session token that was already taken.

What to do now

Inventory Apple devices by OS version in your MDM. Flag anything below iOS 16.7.8, iPadOS 16.7.8, iOS 17.5 or macOS 14.5, and anything still on iOS 16 or 17.
Push updates and block noncompliant devices from corporate resources. Our guide on how to enforce a minimum iOS version with MDM covers compliance rules and update deadlines.
Replace devices that cannot run a current iOS release. The reasoning is in why unsupported iPhones belong on a retirement schedule.
Check Android fleets for Chrome below 146.0.7680.75 and force browser updates through your managed app store.
Search DNS and proxy logs for the infrastructure Sekoia published. A device that contacted the exfiltration host should be treated as having lost its browser cookies.
For any user whose device appears in those logs, revoke active sessions for email, SSO and SaaS apps, and rotate saved passwords and Wi-Fi keys that lived on the device.
If you run a website that loads Plerdy, review what your pages served between August 27 and September 3, 2026, and tell your users if they may have been exposed.

Sekoia's published indicators (defanged):

Delivery: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com
Redirect targets: ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, adsprism-stat[.]com
Exfiltration: ad.starx-net[.]com (port 8881)
Lookalike proxies: america250[.]holiday, theowo[.]club
IPs: 109.104.106[.]107, 192.121.46[.]25, 188.190.17[.]232
Compromised tracker file: a.plerdy[.]com/public/js/click/main.js (27 Aug to 3 Sep 2026)

Sekoia says it withheld further delivery hosts, exfiltration hosts and YARA rules; national CERTs can request them under TLP:AMBER.

What to watch next

Watch for Plerdy's own statement on the compromise, CISA KEV additions for the other bugs in the iOS 18.5 chain, and CERT advisories from Ukraine, the Czech Republic or Bulgaria naming affected sites. If DarkSword components keep circulating, expect more groups to aim them at stale iOS 18 devices.