CVE-2026-86950Apple Ipados Out-of-bounds Write

NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vulnerability Summary

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Severity Level

HIGH(8.8)

Published Date

Sep 28, 2026

Last Modified

Oct 27, 2026

Exploitation Status

ACTIVE

EPSS Score (30-Day)

26.17%Probability

Root Weakness (CWE)

CWE-787: Out-of-bounds Write ↗

The product writes data past the end, or before the beginning, of the intended buffer.

CVSS v3.1 Base Metrics — Score 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

Apple Ipados < 18.7.11
Apple Ipados >= 26.0 and < 26.7.1
Apple Iphone Os < 18.7.11
Apple Iphone Os >= 26.0 and < 26.7.1
Apple Macos < 15.8.1
Apple Macos >= 26.0 and < 26.7.1

Patched Versions

Apple Ipados 18.7.11
Apple Ipados 26.7.1
Apple Iphone Os 18.7.11
Apple Iphone Os 26.7.1
Apple Macos 15.8.1
Apple Macos 26.7.1

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Oct 13, 2026.

Check whether you run Apple Ipados and which version.
Update to a patched version listed above, then confirm the new version.
Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities

Added: Sep 29, 2026
Remediation due: Oct 13, 2026 (deadline passed)

Timeline

Sep 28, 2026Published
Sep 29, 2026Added to CISA KEV catalog
Oct 13, 2026KEV remediation due date
Oct 27, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Apple CVEsYou are reading CVE-2026-86950. Get an email when KEV listings, exploits or new CVEs match your stack.

Notify me about Apple CVEs

Related Coverage

External References

Vendor Advisoryhttps://support.apple.com/en-us/149225
Vendor Advisoryhttps://support.apple.com/en-us/149226
Vendor Advisoryhttps://support.apple.com/en-us/149228
Vendor Advisoryhttps://support.apple.com/en-us/149229
Advisoryhttp://seclists.org/fulldisclosure/2026/Sep/89
Advisoryhttp://seclists.org/fulldisclosure/2026/Sep/90
Advisoryhttp://seclists.org/fulldisclosure/2026/Sep/91
Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950

Data last checked: Nov 14, 2026 04:06 UTC