Apple Releases Security Updates for macOS, iOS, and iPadOS

CVE-2026-86950 is under active exploitation and could lead to arbitrary code execution

Threat ID:: CC-4860
Threat Severity:: Medium
Published:: 30 September 2026 1:30 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

CVE-2026-86950 is under active exploitation and could lead to arbitrary code execution

Affected platforms

The following platforms are known to be affected:

iOS

all versions prior to 26.7.1

iPadOS

all versions prior to 26.7.1

macOS Sequoia

all versions prior to 15.8.1

macOS Tahoe

all versions prior to 26.7.1

Threat details

Active exploitation of CVE-2026-86950

Apple have stated that CVE-2026-86950 has been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

The NHS England National CSOC assesses that further exploitation attempts are likely.

Introduction

Apple has released security updates to address an exploited vulnerability in the CoreGraphics element of macOS Sequoia, macOS Tahoe, iOS, and iPadOS.

CVE-2026-86950 - Out-of-Bounds Write vulnerability that could lead to arbitrary code execution - CVSSv3: 8.8

Remediation advice

Affected organisations are encouraged to review the relevant Apple security releases below and apply the latest updates.

Remediation steps

Type	Step
Patch	iOS 26.7.1 and iPadOS 26.7.1 https://support.apple.com/en-us/149226
Patch	Sequoia 15.8.1 https://support.apple.com/en-us/149229
Patch	Tahoe 26.7.1 https://support.apple.com/en-us/149228

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Last edited: 30 September 2026 1:30 pm