Apple iOS, iPadOS, macOS and visionOS security updates, September 2026: one exploited flaw leads two fixes

The release at a glance

Apple's September 2026 security updates for iOS and iPadOS, macOS and visionOS cover two vulnerabilities in scope for our readers. One is rated high with a CVSS 3.1 score of 8.8; the other has no CVSS score. CVE-2026-86950, the high-severity flaw, is recorded as exploited: CISA added it to the Known Exploited Vulnerabilities catalogue on 29 September 2026 with a due date of 13 October 2026, ENISA EUVD lists exploitation since 29 September 2026, and Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Both vulnerabilities have fixes available. CVE-2026-86950 affects iOS and iPadOS and macOS; CVE-2026-86990 affects iOS and iPadOS, macOS and visionOS. The second flaw is not in CISA KEV and no exploitation is stated in the data.

What matters most

iOS and iPadOS: two vulnerabilities. CVE-2026-86950 is an out-of-bounds write addressed with improved bounds checking. Processing a maliciously crafted file may lead to arbitrary code execution. It has a CVSS 3.1 score of 8.8 (high) and is the only exploited issue in this release; it has its own advisory page on this site. Affected versions are before 18.7.11 and before 26.7.1. CVE-2026-86990 is an access issue addressed with improved access restrictions: a malicious app may be able to access the camera without user permission. No CVSS score or CWE is provided, and no exploitation is recorded. Affected versions are before 18.7.11, before 26.7.2 and before 27.2.

macOS: CVE-2026-86950 affects versions before 15.8.1 and before 26.7.1. CVE-2026-86990 affects versions before 26.7.2 and before 27.2.

visionOS: only CVE-2026-86990 applies, affecting versions before 27.2.

Patch in this order

1. Apply the fixes for CVE-2026-86950 first. This is the exploited out-of-bounds write. Install iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. CISA's KEV entry gives a due date of 13 October 2026.

1. Apply the fixes for CVE-2026-86990. Install iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2, and visionOS 27.2. This camera access issue has no CVSS score and is not recorded as exploited.

Beyond the patch

For a release like this, the decision is straightforward: apply the exploited out-of-bounds write fix first, then the camera access fix. Because exploitation is already recorded by CISA KEV, ENISA EUVD and Apple, detection and response are the first line while patching is in progress. Our Managed Detection & Response (MDR) can help monitor for unusual activity on the affected platforms, and an Incident Response Retainer is the practical way to have support ready if an attack is suspected before patching is complete.