CVE-2026-86950: Apple Zero-Day Exploited
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-09-29. Federal agencies must patch by 2026-10-13.
TL;DR - CVE-2026-86950 is an Apple out-of-bounds write that can lead to arbitrary code execution when a malicious file is processed. - Affected branches include iOS/iPadOS before 26.7.1, macOS Sequoia before 15.8.1, and macOS Tahoe before 26.7.1. - Exploitation has been reported and the CVE is in CISA KEV; patch immediately.
Summary
CVE-2026-86950 is a high-severity Apple vulnerability involving an out-of-bounds write. Apple says the issue is fixed through improved bounds checking and that processing a maliciously crafted file may result in arbitrary code execution. Public reporting associates the affected functionality with Apple’s graphics-processing stack, including CoreGraphics. The retrieved Apple advisory text does not expose complete component-level technical details.
| Field | Assessment |
|---|---|
| CVE ID | CVE-2026-86950 |
| CVSS base score | 8.8 |
| CVSS vector | Not included in the supplied NVD response; verify the current NVD record before formal reporting |
| Attack vector | Requires processing of a maliciously crafted file; exact CVSS attack-vector classification is not confirmed in the supplied data |
| Authentication required | Not specified in the supplied records |
| Privileges required | Not specified in the supplied records |
| Patch available | Yes |
| Exploitation status | Reported in targeted attacks; listed in CISA KEV |
| CISA KEV date added | 2026-09-29 |
| CISA remediation due date | 2026-10-13 |
The immediate operational concern is the evidence of exploitation, not just the CVSS score. Apple reported that the issue may have been used in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. CISA’s Known Exploited Vulnerabilities catalog places the issue beyond a theoretical or laboratory-only weakness.
Treat vulnerable Apple devices as priority remediation targets. Pay particular attention to executive, journalist, researcher, administrator, and other high-risk users. CISA identifies ransomware use as unknown, so KEV inclusion should not be interpreted as evidence that ransomware operators are using this vulnerability.
Root Cause
The stated root cause is an out-of-bounds write caused by inadequate bounds validation while processing a maliciously crafted file. Attacker-controlled data can cause a graphics or file-processing routine to write beyond the intended memory region. Depending on the surrounding mitigations and execution context, that corruption may enable arbitrary code execution.
Apple describes the remediation as “improved bounds checking.” That wording indicates that the fix validates relevant sizes, offsets, or indices before a memory write occurs. The available vendor and NVD descriptions do not identify the exact vulnerable function, file format, memory layout, or exploit primitive.
The likely attack sequence is:
- The attacker prepares a specially crafted file.
- The file reaches a target through an application or service capable of opening, previewing, rendering, or otherwise processing it.
- A vulnerable Apple component handles attacker-controlled content.
- Insufficient bounds validation triggers an out-of-bounds write.
- The attacker may obtain code execution in the context of the affected process and potentially continue through a broader exploit chain.
Third-party reporting associates the issue with CoreGraphics and discusses graphics-related integer conversion or clamping changes. Those details were not confirmed in the retrieved Apple advisory material. Treat them as supplemental technical reporting rather than a definitive vendor-documented root cause.
Who’s Exposed
The supplied NVD description identifies the following affected branches and fixed versions:
| Product | Vulnerable range | Fixed version |
|---|---|---|
| iOS | Versions before iOS 26.7.1; Apple’s exploitation wording specifically references versions before iOS 27 | iOS 26.7.1 or later |
| iPadOS | Versions before iPadOS 26.7.1 | iPadOS 26.7.1 or later |
| macOS Sequoia | Versions before macOS Sequoia 15.8.1 | macOS Sequoia 15.8.1 or later |
| macOS Tahoe | Versions before macOS Tahoe 26.7.1 | macOS Tahoe 26.7.1 or later |
The retrieved NVD response does not provide a complete product-by-product CPE range. Administrators should avoid assuming that an installed branch is safe merely because it has a newer-looking major version. Verify the complete Apple security advisory and compare the installed build against the fixed release for that operating-system branch.
Search results indicate that iOS 27 and macOS 27 were not identified as affected by this particular fix. Validate that information against Apple’s full release documentation and the update availability shown for each device. If an asset cannot be mapped confidently to a fixed Apple release, treat it as potentially exposed until Apple’s advisory or the device’s management system confirms its status.
The highest-risk population includes devices used by individuals who may be targeted with sophisticated file-based attacks. That includes senior executives, public officials, journalists, researchers, human-rights workers, security administrators, and users handling sensitive investigations. The vulnerability is not limited to those groups: any supported device running a pre-fix version can be exposed to malicious file processing.
Severity Breakdown
The recorded CVSS base score is 8.8, which places CVE-2026-86950 in the high-severity category. The supplied NVD response did not include the CVSS vector string, so confirm the exact component values, including attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability impacts, directly in the current NVD record before copying them into a compliance report.
Operationally, the impact is substantial because the vulnerability can lead to arbitrary code execution. A successful exploit may initially execute within a restricted graphics or document-processing process rather than with unrestricted device privileges. The ultimate impact depends on the affected process, platform security controls, sandbox boundaries, and whether the vulnerability is combined with additional flaws.
Do not use the score to downgrade urgency. CISA KEV status and Apple’s disclosure of targeted exploitation are stronger remediation signals than a score alone. The available evidence indicates that exploitation is sophisticated and targeted, but defenders should not assume that a targeted exploit will remain restricted to its original operators once technical details, patches, or reverse engineering become more widely available.
Exploitation Status
Exploitation is confirmed at the assessment level used by CISA KEV. Apple states that it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals using iOS versions before iOS 27. CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on 2026-09-29 and assigned a remediation due date of 2026-10-13.
The known exploitation disclosure specifically identifies iOS in the reported attacks. It does not establish that every affected Apple platform has been exploited, nor does it identify a particular threat actor, campaign, delivery channel, or ransomware operation. CISA’s ransomware-campaign field is unknown.
A verified public proof of concept is not established by the primary sources supplied for this assessment. Third-party reporting claims that a public PoC or patch-diff analysis may exist, but no primary repository or independently validated reproduction procedure was provided. The defensible status is therefore:
- In-the-wild exploitation: Confirmed or reported; supported by Apple’s disclosure and CISA KEV listing.
- Public PoC: Not verified from the primary sources reviewed.
- Ransomware use: Unknown.
- Exploit delivery mechanism: Unknown.
Analyst’s Take: Patch first, then investigate exposure on high-risk devices. The combination of reported targeted exploitation and CISA KEV status outweighs the absence of a verified public PoC, while the limited technical detail means detection should focus on suspicious file processing and post-crash activity rather than a narrow exploit signature.
Technical Notes
Do not wait for a public PoC before patching. KEV inclusion means defenders should assume that capable attackers may possess private exploit material, even if the technical reproduction is not publicly available.
Security teams can also review foundational threat-hunting concepts when building detection coverage for suspicious crashes, file processing, and post-exploitation activity.
Sources
- NVD: CVE-2026-86950 — CVE description, CVSS score, references, and publication history.
- Apple security content for iOS 26.7.1 and iPadOS 26.7.1 — Apple’s affected-platform and remediation information.
- Apple security content for macOS Tahoe 26.7.1 — macOS Tahoe security fixes.
- Additional Apple security advisory — Apple advisory reference identified by NVD.
- CISA Known Exploited Vulnerabilities Catalog — KEV status, remediation requirements, and exploitation significance.
- Full Disclosure reference — NVD-linked disclosure material.
- Full Disclosure reference — NVD-linked disclosure material.
- SANS Internet Storm Center discussion — supplemental technical context.
- Security Affairs report — unverified third-party reporting about possible public PoC material.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection is difficult because exploitation may begin when a user previews or opens a malicious file, and Apple’s public description does not identify a unique file format or delivery mechanism. Security teams should correlate endpoint crash events, abnormal process termination, suspicious file delivery, and follow-on activity such as unexpected child processes or credential access.
On macOS, the following command can be used as an initial triage query for crash and graphics-processing indicators. It is not a definitive exploit signature, and event-message wording varies by OS build and logging configuration:
log show --last 7d \
--predicate '(eventMessage CONTAINS[c] "CoreGraphics" OR eventMessage CONTAINS[c] "EXC_BAD_ACCESS" OR eventMessage CONTAINS[c] "EXC_BAD_ACCESS KERN_INVALID_ADDRESS")' \
--style syslog
A useful endpoint hunting approach is to search for a crash involving a graphics or document-preview process followed shortly by an unexpected process launch. An EDR query can be adapted to the platform’s schema using logic similar to:
crash.process IN ("Preview", "QuickLookSatellite", "sharingd", "Safari", "WebKit")
AND crash.exception CONTAINS "EXC_BAD_ACCESS"
AND process_creation.timestamp - crash.timestamp BETWEEN 0 AND 300
The process names and fields above are illustrative and must be mapped to the organization’s EDR. On iOS and iPadOS, obtain crash and threat telemetry through the organization’s MDM, mobile threat defense, and Apple security logging integrations where available. Look for unusual file receipt or preview events, application crashes, repeated processing failures, and post-crash activity on accounts associated with targeted users.
Preserve relevant telemetry before wiping or re-enrolling a potentially compromised device when incident-response requirements apply. A crash alone does not prove exploitation. A crash involving a suspicious file and subsequent abnormal process or account activity warrants investigation.
Because targeted exploitation can be followed by account compromise, organizations should also review authentication activity and enforce phishing-resistant multifactor authentication where possible. A centrally managed password manager such as Try 1Password → can help users maintain unique credentials, but it does not replace patching or endpoint investigation.
Remediation Steps
Upgrade affected devices to the fixed releases:
- iPhone devices: iOS 26.7.1 or later.
- iPad devices: iPadOS 26.7.1 or later.
- Macs running Sequoia: macOS Sequoia 15.8.1 or later.
- Macs running Tahoe: macOS Tahoe 26.7.1 or later.
For managed fleets, use MDM software-update commands or declarative device management to enforce the applicable release. On a Mac, an administrator can first inspect available updates and then install them with Apple’s native updater:
softwareupdate --list
sudo softwareupdate --install --all
After installation, verify the running version rather than relying only on a successful MDM job status:
sw_vers
For iOS and iPadOS, use the organization’s MDM update command and verify the resulting OS version in inventory. Do not assume that a device is remediated because an update was offered; confirm the installed version is at least 26.7.1 for the affected branches.
Organizations tracking multiple Apple flaws can also compare their remediation process with related CVE-2026-16635 vulnerability guidance.
Technical Notes
No vendor-documented workaround that fully removes the vulnerability was provided in the supplied sources. If immediate patching is impossible, reduce exposure by restricting the affected device’s ability to receive or process untrusted files, isolate it from sensitive services, and prioritize replacement or suspension of use. These measures reduce risk but do not substitute for the Apple update.
CISA’s KEV guidance requires organizations to apply vendor mitigations according to the applicable security-update requirements, including BOD 26-04 where relevant. If no mitigation is available, CISA catalog guidance states that stakeholders should discontinue use of the product where applicable. Because this issue has reported exploitation, organizations should also preserve forensic data and investigate high-risk devices that were exposed before remediation.