Vulnerability: CVE-2024-27834 allows attackers with arbitrary memory read and write capabilities to bypass Apple’s Pointer Authentication protection.
Exploitation: Researchers reported mobile exploit delivery through compromised websites, impersonation sites, and Plerdy SEO Tracker. The Midnight Blizzard connection remains an assessment.
Available fixes: Apple patched the flaw in May 2024. Other vulnerabilities used in the campaign also had fixes available before exploitation.
Enterprise response: Verify installed software against applicable fixes. Hexnode UEM can support version compliance checks and update workflows on eligible managed devices.
CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, following evidence of active exploitation. Apple patched the Pointer Authentication bypass in May 2024, but researchers subsequently identified its use in a mobile watering-hole campaign.
The campaign combined compromised websites, imitation sites, and a compromised analytics script to deliver exploits to visiting devices. Researchers assessed a connection to Russia’s Midnight Blizzard. For enterprise teams, the concern is whether deployed devices have received the relevant updates, including fixes available long before the latest warning.
From Apple’s patch to CISA’s exploitation warning
The timeline separates the original fix from the subsequent remediation requirement:
May 2024: Apple released fixes across iOS, iPadOS, macOS, Safari, tvOS, and watchOS.
November 4, 2026: CISA added the vulnerability to KEV based on evidence of active exploitation.
November 18, 2026: The KEV entry’s federal remediation deadline.
CISA’s announcement confirms exploitation of the vulnerability. The campaign details and suspected Midnight Blizzard connection come from researchers’ reporting.
Cybersecurity essentials for any organization
Explore cybersecurity essentials for protecting organizational data, devices, and networks.
How the campaign reached mobile users
The campaign targeted mobile users in the United States and Europe through three delivery routes:
Delivery route
Reported activity
Enterprise significance
Compromised websites
Malicious JavaScript inserted into legitimate sites
Ordinary browsing could expose unpatched devices.
Impersonation sites
Fake sites copied trusted destinations
Familiar branding did not establish safety.
Plerdy SEO Tracker
Analytics script compromised for one week
Third-party code expanded exposure across sites using the component.
The Plerdy script was loaded by thousands of predominantly Ukrainian websites. That distribution should not be interpreted as a count of successfully compromised devices. Delivery code profiled visitors before serving platform-specific exploit chains.
How CVE-2024-27834 supported cookie theft
Pointer Authentication provides hardware-backed checks on certain pointers. Apple states that this vulnerability requires an attacker who already has arbitrary memory read and write capability.
The reported iOS chain combined separate stages:
Initial capability: A WebKit remote-code-execution flaw provided the initial exploitation capability.
Protection bypass:CVE-2024-27834 bypassed Pointer Authentication, helping the attacker proceed with code execution.
Collection: The chain executed a JavaScript payload designed to steal cookies.
The reported zero-click behavior required no further interaction after malicious web content loaded. Website exposure was still part of the delivery process.
A separate Android chain exploited vulnerabilities in Chrome and Qualcomm chipsets. Those flaws were already patched before the campaign; they are distinct from the Apple vulnerability.
What enterprise teams should verify
The response should cover the software involved in each platform’s exposure:
Inventory versions: Review installed OS and browser versions across managed Apple and Android devices.
Match applicable fixes: Verify devices against Apple’s May 2024 security releases, including iOS/iPadOS 17.5 or 16.7.8 for supported devices, macOS Sonoma 14.5, Safari 17.5, watchOS 10.5, and tvOS 17.5. Check the latest vendor guidance for subsequent security updates and the separate Chrome and Qualcomm vulnerabilities involved in the campaign.
Verify completion: Confirm installed versions after deployment and identify devices that remain below requirements.
The May 2024 Apple fixes address this particular flaw. They are not a complete baseline for every exploit used in the wider campaign.
How Hexnode supports managed-device remediation
Hexnode UEM helps administrators identify devices below configured OS requirements, manage supported updates, and review compliance across enrolled devices.
Identify outdated devices
Configure OS version criteria under Policies > Compliance Policies > Advanced Settings to flag devices running below your required version.
Apply supported updates
Use the Update OS action on eligible Apple devices. For Android Enterprise devices enrolled as Device Owner, configure OS update policies to install available updates automatically or during inactive hours.
Restrict access to malicious websites
Use Hexnode’s Web Content Filtering policies on supported iOS, macOS, and Samsung Knox devices to block known malicious URLs while patches are being deployed. Apply platform-specific policies to eligible devices to reduce exposure to identified malicious websites. This provides an additional layer of protection but does not replace patching.
Check enrollment prerequisites
The iOS/iPadOS Update OS action requires supervision, while Android OS update scheduling requires Device Owner enrollment. For BYOD devices enrolled through Android Profile Owner or iOS User Enrollment, use supported compliance checks and enable user notifications for non-compliant devices to guide manual remediation. Where configured, conditional access can restrict organizational resource access based on device compliance status.
Review compliance afterward
Navigate to Reports > Built-in Reports > Compliance > Non-compliant Devices to identify devices failing configured compliance requirements across the fleet. Filter by device type or ownership and export the report for further review. Verify reported OS versions separately to confirm patch completion.
These workflows support patch verification on managed devices. Compliance status alone does not establish whether a device encountered the campaign’s malicious JavaScript or was previously compromised.
Featured resource
The Cybersecurity Blueprint
Learn how to choose and implement a cybersecurity strategy aligned with your organization’s security needs.
Does the KEV listing confirm Midnight Blizzard attribution?
No. CISA confirms evidence of exploitation. The suspected connection to Midnight Blizzard comes from the researchers’ assessment.
Does CVE-2024-27834 affect Android?
This CVE concerns Apple products. The campaign’s Android exploit chain used separate Chrome and Qualcomm vulnerabilities.
Can the same update controls cover every BYOD device?
Update capabilities depend on platform and enrollment type. Verify supported controls before relying on enforced updates for personally owned devices.
Keep patch verification continuous
The CVE-2024-27834 CISA KEV listing shows why older fixes remain operationally relevant. Maintain current platform-specific baselines, prioritize devices below them, and verify remediation. A patch only reduces a device’s exposure once you install the applicable update.
Keep device updates in focus with Hexnode.
Review device versions, manage supported updates, and track compliance.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
