Severity: High (CVSS 8.8)

Affected Systems: Apple Ipados; Apple Iphone Os; Apple Macos

Overview

A high vulnerability identified as CVE-2026-86950 has been disclosed.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CISA KEV: This CVE is listed as a known exploited vulnerability. Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

CISA due date: 2026-10-02

Risk

CVSS and CISA data indicate the following:

  • Listed by CISA as a known exploited vulnerability
  • CVSS attack vector is Network, so exposure depends on whether the affected service or component is reachable
  • Privileges required: NONE
  • User interaction: REQUIRED
  • Scope: UNCHANGED

Required Action

Review the linked vendor and NVD advisory, then apply the vendor-provided update or mitigation for the affected product.

Prioritize systems where the affected product is internet-facing, handles authentication, or runs with elevated privileges.

Verify Updates

Confirm whether your environment uses the affected product(s): Apple Ipados; Apple Iphone Os; Apple Macos.

After remediation, verify the installed version against the fixed or unaffected versions listed by the vendor.

Temporary Mitigation (if patch is not available)

Use the mitigation published by the vendor. If no vendor mitigation is available, reduce exposure to the affected product, restrict access to trusted users or networks, and increase monitoring until an update can be applied.

Recommendation

  • Use OpenCVE, vendor, and source references as the source of truth for affected versions and remediation
  • Patch or mitigate affected products after confirming exposure in your environment
  • Monitor affected systems for unusual activity until remediation is complete

Support

If you require assistance, please contact our support team.

Immediate action is strongly recommended to protect your infrastructure.

Source Details

Customer Responsibility and Backups

Before applying updates, mitigations, or configuration changes, customers should take and verify current backups or snapshots of affected systems.

Customers are responsible for managing their servers, validating their own backups, testing changes, and ensuring they can restore services if an update or mitigation causes an issue.



Tuesday, September 29, 2026

« Back