CVE-2026-86950 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2026-09-28

Added to CISA KEV: 2026-09-29 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Apply Apple emergency security updates — iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. This is an actively exploited zero-day with no workaround other than patching.
THREAT HUNTING: Given the confirmed active exploitation in 'extremely sophisticated targeted attacks,' organizations with high-value targets (executives, journalists, legal/political figures, critical infrastructure personnel) should treat this as a priority incident response item. Review devices used by these individuals for signs of compromise.
MDM/UEM ENFORCEMENT: Enterprise Mobile Device Management (MDM) administrators should immediately push OS update policies to enforce minimum version requirements (iOS/iPadOS 26.7.1, macOS 15.8.1 or 26.7.1) across managed devices. Use MDM compliance policies to flag non-compliant devices.
INDICATORS OF COMPROMISE: Although no public PoC exists, monitor for anomalous process behavior on Apple devices, unexpected network connections, or signs of spyware activity (e.g., battery drain, elevated background data usage, unexpected microphone/camera activation). Engage Apple forensics or a mobile threat defense (MTD) vendor if targeted attack is suspected.
FILE DELIVERY VIGILANCE: Since exploitation requires processing a maliciously crafted file, train users to exercise extreme caution with unexpected file attachments (email, iMessage, WhatsApp, AirDrop) from unknown or unverified senders. Do not open unsolicited files until devices are patched.
MOBILE THREAT DEFENSE: For high-risk individuals or organizations, deploy an MTD solution (e.g., Jamf Protect, Microsoft Defender for Endpoint on iOS/macOS) that can detect exploitation attempts or post-compromise indicators.
BYOD POLICY REVIEW: Organizations with BYOD policies allowing unmanaged Apple devices to access corporate resources (email, VPN, SharePoint) should temporarily restrict access from devices that cannot be verified as patched.
PATCH PRIORITY LEVEL: CRITICAL — patch within 24–48 hours for all managed devices. This is an actively exploited zero-day used in sophisticated targeted attacks. Do not delay patching pending change management cycles.

🔍 Web Intelligence (Kagi · 2026-09-29)

Summary

CVE-2026-86950 is a severe out-of-bounds write memory corruption vulnerability residing in the CoreGraphics component of Apple’s operating systems. This flaw occurs due to a lack of rigorous verification during memory operations when processing a maliciously crafted file. The vulnerability is highly significant because it has been identified as a zero-day that is actively being exploited in "extremely sophisticated" targeted attacks, and it allows attackers to achieve arbitrary code execution on compromised devices.

Exploitation

Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild in sophisticated targeted attacks ^[3]^[4].
Threat Actors: The vulnerability was reported by Meta, though specific threat actor groups have not been publicly named ^[3].
Availability: As of September 29, 2026, there are no public proof-of-concept exploits available for this zero-day.
Attack Prerequisites: Exploitation typically requires the victim to process a specially crafted, malicious file ^[1]. It does not necessarily require authentication or local network access by the attacker, as the attack is triggered by the application/system opening the weaponized content.

Affected Products & Patches

Affected Versions: The vulnerability impacts versions of iOS, iPadOS, and macOS, including iOS 26, macOS 26, and macOS 15. Newer versions (e.g., iOS and macOS 27) are not affected ^[2].
Patches: Apple has released emergency security updates to address this flaw ^[2]. Users are strongly advised to update their devices immediately.
Mitigations: There are no known workarounds other than applying the official security patches provided by Apple.

Impact

Capabilities: Successful exploitation grants an attacker the ability to execute arbitrary code on the target device, potentially running with user privileges or higher, which can lead to complete device compromise ^[1].
Business Risk: For internet-facing or mobile-integrated corporate deployments, this vulnerability poses a critical risk of data exfiltration, unauthorized access to sensitive internal information, and the potential for a foothold into protected enterprise environments via mobile device management (MDM) or BYOD endpoints.

Sources

CVE-2026-86950 - Vulnerability Details - OpenCVE
An out-of-bounds write flaw was found in Apple operating systems when processing a specially crafted file. The flaw leads to arbitrary code execution on the affected device and is considered a severe memory corruption weakness. It matches the common weakness pattern of out-of-bounds writes, which ca…
Apple Emergency Patch for iOS 26, macOS26, macOS15 ...
The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected.
Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’
Apple patched a CoreGraphics zero-day (CVE-2026-86950) reported by Meta, warning the flaw was targeted in extremely sophisticated attacks.
Apple squashes zero-day bug exploited in "extremely ...
Apple ships iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in Core Graphics framework.

🟢 CVE-2026-86950