CISA has added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) catalog. It is an out-of-bounds write in Apple CoreGraphics that can lead to arbitrary code execution, and federal agencies must remediate it by October 2, 2026.
What Is It
CVE-2026-86950 is an out-of-bounds write (CWE-787) in CoreGraphics, and it affects Apple iOS, iPadOS, and macOS. According to Apple, processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed the issue by improving bounds checking.
NVD rates it CVSS 3.1 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack works over the network, is low in complexity, and needs no privileges. It does require user interaction, and a successful attack fully compromises confidentiality, integrity, and availability.
Why It Matters
This flaw is being exploited in the wild. Apple says it is aware of a report that the issue may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27. CISA confirmed active exploitation by adding the CVE to KEV on 2026-09-29, and its SSVC assessment rates exploitation as "active" with "total" technical impact.
CISA also marked this entry for forensic triage. Organizations should therefore check for signs of prior compromise in addition to patching. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
- iOS and iPadOS versions before 26.7.1
- macOS Sequoia versions before 15.8.1
- macOS Tahoe versions from 26.0 up to, but not including, 26.7.1
Patch Status
Apple has released fixes in:
- iOS 26.7.1 and iPadOS 26.7.1
- macOS Sequoia 15.8.1
- macOS Tahoe 26.7.1
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Organizations should follow the applicable BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders are responsible for assessing each asset's internet exposure. The federal remediation due date is 2026-10-02.
Sources
- CISA KEV Catalog – CVE-2026-86950
- NVD – CVE-2026-86950
- Apple Security Advisory 149226
- Apple Security Advisory 149228
- Apple Security Advisory 149229
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
- Full Disclosure – 2026/Sep/89
- Full Disclosure – 2026/Sep/90
- Full Disclosure – 2026/Sep/91