Actively Exploited Apple Multiple Products Bug (CVE-2026-86950) Gets Federal Patch Deadline

CISA has confirmed in-the-wild exploitation of CVE-2026-86950, an out-of-bounds write flaw affecting Apple Multiple Products. The agency added the vulnerability to its KEV catalog on September 29, 2026.

At a glance

CVE

CVE-2026-86950

Vendor

Apple

Product

Multiple Products

CVSS

8.8 HIGH

Weakness

out-of-bounds write

Exploited

Yes (CISA KEV)

Ransomware use

Unknown

Patch deadline (FCEB)

October 2, 2026

What we know about CVE-2026-86950

CISA's catalog entry describes the issue as follows: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

The National Vulnerability Database lists a CVSS base score of 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

The NVD record adds: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Affected products

Who is at risk?

CISA does not currently link this vulnerability to ransomware campaigns, but KEV listings mean exploitation has already been observed. Under CISA's binding operational directives, Federal Civilian Executive Branch agencies must remediate it by October 2, 2026. CISA urges every organisation, not only federal agencies, to treat KEV entries as a patching priority.

What should you do?

• Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• Apply the vendor's fix or mitigation now; CISA lists the bug as exploited in real attacks.
• If no patch is available, follow the vendor's workaround or take the product offline.
• Check logs on exposed systems for signs of compromise before and after patching.
• Restrict management interfaces so they are not reachable from the internet.

What to do and how to stay safe: CVE-2026-86950

• Patch scores alone ignore context like network exposure and asset criticality.
• You must map vulnerabilities to specific business risks to prioritize correctly.
• Continuous exposure data replaces static scanning for accurate prioritization.

Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-86950?

CVE-2026-86950 is a out-of-bounds write vulnerability in Apple Multiple Products.

How severe is CVE-2026-86950?

It has a CVSS score of 8.8 HIGH.

Is CVE-2026-86950 being exploited?

Yes. CISA lists it in its Known Exploited Vulnerabilities catalog, which means attacks have been observed.

What is the deadline to patch CVE-2026-86950?

US federal civilian agencies must remediate it by October 2, 2026. Other organisations are urged to treat it as a priority.