On 28 September 2026 Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics. Apple says it is "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." CISA added the CVE to the Known Exploited Vulnerabilities catalog on 29 September with a due date of 13 October.
The bug was reported by Meta Product Security. Apple's impact line is short: processing a maliciously crafted file may lead to arbitrary code execution.
What's affected
Apple's three security notes all describe the same CoreGraphics fix, "improved bounds checking". NVD scores it 8.8 under CVSS 3.1 with user interaction required, which fits a file that has to be opened or rendered.
| Platform | Fixed release | Devices |
|---|---|---|
| iOS and iPadOS | 26.7.1 | iPhone 11 and later, iPad Pro 12.9-inch 3rd gen and later, iPad Pro 11-inch 1st gen and later, iPad Air 3rd gen and later, iPad 8th gen and later, iPad mini 5th gen and later |
| macOS Tahoe | 26.7.1 | Macs on Tahoe |
| macOS Sequoia | 15.8.1 | Macs on Sequoia |
What about the 27 releases? Apple's phrasing puts the observed exploitation on versions before iOS 27. Apple's security notes for iOS 27 and macOS Golden Gate 27, released 14 September, do not list CVE-2026-86950, and Apple lists iOS 27.0.1 and macOS Golden Gate 27.0.1, released the same day as the fix, as having "no published CVE entries". So for devices on the 27 line, keep them on the current 27.x release and watch Apple's security releases page for any later entry. The concrete, documented fixes are 26.7.1 and 15.8.1.
One group needs special attention. Comparing the device lists in Apple's notes, iOS 26.7.1 covers some iPads that iOS 27 does not: iPad Pro 12.9-inch 3rd generation, iPad Pro 11-inch 1st generation, iPad Air 3rd generation, iPad 8th generation and iPad mini 5th generation. Those devices can't move to 27. For them, 26.7.1 is the only fix.
How to check if you're exposed
Macs. On a single machine:
sw_vers -productVersion
Tahoe below 26.7.1 or Sequoia below 15.8.1 is unpatched. Across a fleet, use your MDM's OS version report, or query each machine through your management agent and flag those values.
iPhone and iPad. In your MDM, build a smart group or report for devices where the OS version is on the 26 line and below 26.7.1. On the device itself, the version is under Settings, General, About.
Find the stragglers. The devices that stay vulnerable longest are usually unmanaged ones: personal phones used for work email, kiosk iPads, and old test devices. Cross-check your MDM list against your identity provider's device records to find anything signing in that MDM doesn't know about.
What to do now
- Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through MDM with an enforced install deadline, rather than relying on users to accept a prompt.
- Give the iPads stuck on iOS 26 their own group so they don't fall out of reports when the rest of the fleet moves to 27.
- For people at higher risk of targeted attacks, such as executives, legal, security staff and anyone who travels to hostile jurisdictions, check their devices individually today instead of waiting for fleet compliance numbers.
- Keep devices on the 27 line at the latest 27.x release and re-check Apple's security notes, since Apple has not published a 27-series entry for this CVE.
- Note the timeline for your records: CISA gave 14 days for this entry, a longer window than most, which gives you room to stage the rollout but not to skip it.
Why it matters
Image and document parsers are a favorite entry point for targeted mobile attacks because the user does not need to do anything unusual. Opening an attachment or viewing a file is normal behavior. Apple's "specific targeted individuals" language means most people were not hit, but the ones who were are often the people with the most sensitive access.
The KEV timing is also worth noting. Of the 61 entries CISA added between 1 September and 16 October 2026, 52 got a three-day remediation window. This one was among the nine that got 14 days, alongside two Chromium V8 bugs and two Windows privilege escalation bugs. A longer window is a signal about deployment reality, not about risk. Mobile fleets take time to update, so the work needs to start the day the fix ships.
Try it yourself
Export your MDM device inventory to CSV with OS version and model. Filter for iOS or iPadOS versions on the 26 line below 26.7.1, and separately list the five iPad models that cannot run iOS 27. Count how many devices you find, and how many have no user assigned. Then walk through how a fix that is already available should be prioritized in this demo:
Click through it at your own pace, or open it full screen.
Quick check
Which component has the bug?
CoreGraphics. Apple describes an out-of-bounds write that can lead to arbitrary code execution when processing a maliciously crafted file.
My iPad Air 3rd generation can't install iOS 27. Is it protected?
Only if it is on iPadOS 26.7.1 or later. That release lists the iPad Air 3rd generation as supported and includes the fix.
What is the KEV due date?
13 October 2026, 14 days after CISA added the CVE on 29 September.
Sources
- Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1
- Apple: About the security content of macOS Tahoe 26.7.1
- Apple: About the security content of macOS Sequoia 15.8.1
- Apple security releases
- Apple: About the security content of iOS 27 and iPadOS 27
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog (29 September 2026)
- CISA Known Exploited Vulnerabilities Catalog
- NVD: CVE-2026-86950
