CISA added Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after finding evidence of active exploitation, and set a November 18, 2026, patch deadline for Federal Civilian Executive Branch agencies.

Rated medium severity at 5.5, CVE-2024-27834 lets an attacker who already has arbitrary read-and-write access bypass Pointer Authentication, a hardware-backed memory protection; it is not an entry point on its own, but can strengthen an exploit chain.

Sekoia attributed the campaign to APT29, also known as Cozy Bear and Midnight Blizzard, with moderate-to-high confidence; the article describes the attribution as Sekoia’s assessment, not a finding by CISA or Apple.

Sekoia reported a spy campaign in which compromised legitimate websites, impersonation sites, or a tampered Plerdy SEO Tracker script delivered malicious JavaScript; visiting an infected page could trigger the attack without a tap or download.

The chain paired the Pointer Authentication bypass with a WebKit remote-code-execution flaw and CVE-2025-43529, enabling attackers to steal browser cookies and collect sensitive browser and device data.

For older iPhones, stolen cookies—including those stored in app containers—could let attackers access logged-in accounts without a password and potentially bypass an additional login code.

Sekoia said the vulnerabilities used in the three reported attack chains were not zero-days because patches existed before the campaign began, but reported that CVE-2026-20700 remained unfixed on the iOS 18 line as of November 5, 2026.

Apple issued fixes in May 2024, including in iOS 17.5 and macOS Sonoma 14.5; affected systems include devices that missed those updates, such as iPhones and iPads below iOS 16.7.8 or 17.5, Macs running earlier Sonoma versions, and older Apple TV, Apple Watch software, and Safari versions.

Apple offered no workaround, so users should install available updates; the article recommends iOS 26.3 where supported, at least iOS 16.7.8 on devices that cannot upgrade further, and Chrome 146.0.7680.75 or later on Android.

Organizations should use device-management and access records to find outdated devices, enforce minimum software versions for business access, and watch unpatched devices and associated accounts for suspicious connections or unusual access and session behavior.

CISA urged non-federal organizations to check for affected systems and apply the May 2024 patches, though the number of unpatched private-sector systems is unknown.

If cookie theft is suspected, organizations should investigate account activity and revoke affected sessions, since stolen session cookies can enable access without a password.