On September 28, 2026, Apple released security updates for iOS, iPadOS, and macOS that fix the CVE-2026-86950 vulnerability in the CoreGraphics component. According to Apple, the vulnerability may already have been used in “highly sophisticated attacks” against specific users on iOS versions prior to iOS 27. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of October 2, 2026. All users of affected devices — iPhone 11 and newer, iPad Pro, iPad Air, iPad and iPad mini of the corresponding generations, as well as Macs running macOS Tahoe and macOS Sequoia — need to install the updates immediately.
Technical details of the vulnerability
CVE-2026-86950 is an out-of-bounds write vulnerability in the CoreGraphics component — a system library responsible for processing graphic content across all Apple platforms. Processing a specially crafted malicious file can lead to arbitrary code execution on the victim’s device. Apple addressed the issue through improved buffer bounds checking.
A CVSS score for CVE-2026-86950 had not been assigned by either NVD or CISA-ADP at the time of publication. However, the inclusion of the vulnerability in the CISA KEV catalog on September 29, 2026, with a remediation deadline of October 2 indicates that the agency assesses the risk as sufficiently high to require mandatory response from U.S. federal agencies.
Discovery of the vulnerability is attributed to the Meta Product Security team. It is important to emphasize that Meta appears here solely as the researcher who discovered and reported the issue — the publicly available materials contain no information about attribution of the threat actors.
Affected platforms and updates
Patches have been released for the following operating system versions:
- iOS 26.7.1 and iPadOS 26.7.1 — iPhone 11 and newer, iPad Pro 12.9″ (3rd generation and newer), iPad Pro 11″ (1st generation and newer), iPad Air (3rd generation and newer), iPad (8th generation and newer), iPad mini (5th generation and newer)
- macOS Tahoe 26.7.1 — Mac computers running macOS Tahoe
- macOS Sequoia 15.8.1 — Mac computers running macOS Sequoia
Notably, Apple released a patch simultaneously for both the current (Tahoe) and previous (Sequoia) macOS versions, expanding protection coverage to devices that have not yet migrated to the latest system version.
What is known about exploitation
Apple’s wording — “Apple is aware of a report that this issue may have been exploited” — indicates possible, but not independently confirmed, exploitation. The company has not disclosed the number of victims, the success rate of attacks, or the date of the first incident. At the time of publication, no independent confirmations of active exploitation in open sources had been found. Nevertheless, inclusion in CISA KEV indicates that the agency considered the available data sufficient to classify the vulnerability as exploited.
The attack vector — processing of a malicious file — implies that for successful exploitation the attacker must deliver a specially crafted file to the victim’s device. This can occur through message attachments, email, or downloads from a web resource. The available materials contain no information on whether exploitation is possible without user interaction.
Context: the second targeted Apple vulnerability in 2026
CVE-2026-86950 is not the first Apple vulnerability in 2026 that the company has associated with targeted attacks. In February, Apple fixed CVE-2026-20700 — a memory corruption bug in the dyld component that allows arbitrary code execution given the ability to write to memory. This vulnerability received a CVSS 7.8 (high) score from CISA-ADP and was patched in iOS/iPadOS 26.3, macOS Tahoe 26.3, and other platforms on February 11, 2026. Its CISA KEV deadline — March 5, 2026 — has already passed. Discovery of CVE-2026-20700 is attributed to Google Threat Analysis Group.
The involvement of Meta Product Security and Google Threat Analysis Group in discovering both vulnerabilities is typical of situations where large technology companies uncover exploitation of vulnerabilities while investigating attacks on their users or infrastructure. Previously, we covered Apple’s practice of notifying victims of spyware, and also analyzed other macOS vulnerabilities that affected the same operating system versions.
Recommendations
- Install updates immediately: iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1, depending on the platform. The CISA KEV deadline is October 2, 2026.
- Check the system version on all managed Apple devices: on iPhone and iPad — “Settings → General → About”, on Mac — Apple menu → “About This Mac”.
- For organizations with a fleet of Apple devices: use MDM solutions for centralized deployment of updates and compliance control.
- Make sure CVE-2026-20700 is also remediated: if your infrastructure still has devices running versions below iOS/iPadOS 26.3 or macOS Tahoe 26.3, they remain vulnerable to the February dyld vulnerability.
Given the three-day CISA KEV deadline and the nature of the vulnerability, which allows arbitrary code execution through file processing, the update priority is maximal. Organizations that are unable to update devices by October 2 should restrict processing of files from untrusted sources on affected devices as a temporary measure until the patch is installed.
