Apple zero-day CVE-2026-86950: CoreGraphics flaw exploited

Apple has fixed CVE-2026-86950, a vulnerability in CoreGraphics, the framework that handles graphics across its operating systems. According to the vendor, the flaw may already have been exploited in an “extremely sophisticated” attack against carefully selected individuals. On 29 September CISA added it to the Known Exploited Vulnerabilities (KEV) catalog, with a 13 October deadline for US federal agencies.

What happened

Apple’s security bulletin, published on Monday 28 September, describes an out-of-bounds memory write in CoreGraphics. By getting the device to process a specially crafted file, an attacker can achieve arbitrary code execution. Apple fixed the issue with improved bounds checking.

The vendor says it is aware of a report that the flaw may have been exploited against targeted individuals on versions of iOS before iOS 27. It does not say which versions were hit, who was behind the attacks, how many people were involved or how the file was delivered. The vulnerability was reported to Apple by the Meta Product Security team. Neither Apple nor Meta has published further technical details.

Technical details

• CVE: CVE-2026-86950, out-of-bounds write (CWE-787) in CoreGraphics. CISA lists it as an “Apple Multiple Products” vulnerability.
• Effect: arbitrary code execution while processing a malicious file.
• Fixed versions: iOS 26.7.1 and iPadOS 26.7.1. According to Infosecurity Magazine, the fix also shipped with macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The Register mentions only iOS and iPadOS.
• Devices receiving the update:
  • iPhone 11 and later;
  • iPad Pro 12.9-inch, third generation and later;
  • iPad Pro 11-inch, first generation and later;
  • iPad Air, third generation and later;
  • iPad, eighth generation and later;
  • iPad mini, fifth generation and later.
• Attack vector: a specially crafted file. The delivery channel (messages, attachments, browsing) has not been disclosed.
• MITRE ATT&CK: T1203 (Exploitation for Client Execution) for macOS and the matching Mobile matrix technique, T1658. The entry vector is unknown, so the initial access technique cannot be mapped.
• Indicators of compromise: none published.
• Ransomware use: unknown, according to CISA.

Context

According to The Register, this is the seventh zero-day Apple has fixed in 2026. The vendor uses the same wording, “extremely sophisticated attack against specific targeted individuals”, for cases of targeted exploitation. In February 2025, for example, it used it for CVE-2025-24200, discovered by researchers at the Citizen Lab. The press notes that vulnerabilities of this kind have been linked to commercial spyware vendors in the past. For CVE-2026-86950, however, no source attributes the attack to a specific actor or tool.

Infosecurity Magazine also points out that in September Apple fixed CVE-2026-86869, a zero-click vulnerability that could be triggered with a crafted iMessage. There are no reports of that flaw being exploited, though.

Impact for European and Italian companies

Targeted attacks of this kind are very relevant to businesses: executives, system administrators and people handling sensitive information are typical targets. These are often the same people who get exceptions to update policies. A compromised smartphone gives access to email, messages, multi-factor authentication and business apps.

For NIS2 entities, company smartphones and tablets are assets to be managed: inventory, updates and vulnerability management must cover them too, not just computers and servers. In healthcare, where iPads are often used on the ward to look up clinical data, an unpatched device is a direct risk to patient data.

What to do right now

1. Take inventory: from your mobile device management (MDM) console, list the iPhones and iPads running a version below 26.7.1 and the Macs on macOS releases older than Tahoe 26.7.1 or Sequoia 15.8.1. Check Apple’s bulletin for the full list of fixed systems.
2. Enforce the update: set a short deadline through MDM and keep user deferrals to a minimum, including exceptions for executives.
3. Start with high-risk people: define a list of the most exposed users, update their devices first and consider Apple’s Lockdown Mode for them.
4. Handle excluded devices: models that do not receive the update remain vulnerable. Remove their access to company data or replace them.
5. Prepare your response: there are no public indicators. If you suspect a high-risk user’s device has been hit, do not restore it straight away: cut it off from company accounts, revoke sessions and tokens and hand it over for specialist forensic analysis. Make sure your incident response plan covers smartphones as well, not just computers.

How ARXDOME helps

On Macs, the ARX Sentry agent collects the system and software inventory, so it shows right away which machines still run a vulnerable version of macOS. ARX Shield lists open vulnerabilities by machine and highlights those already exploited by attackers, like this one. ARX Horizon lets you look up vulnerability details from the portal. For iPhones and iPads, the MDM console remains the control point.

Last updated: 30 September 2026