Apple iOS and macOS out-of-bounds write permits arbitrary code execution (CVE-2026-86950)

What happened

CVE-2026-86950 is an out-of-bounds write in Apple operating systems that Apple addressed with improved bounds checking. The CVSS vector describes a network-based attack with low complexity and no privileges. The target must process a maliciously crafted file; successful exploitation can lead to arbitrary code execution, with high impact on confidentiality, integrity and availability.

Apple's advisory states that Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CISA added the CVE to the Known Exploited Vulnerabilities catalogue on 29 September 2026, and the KEV entry also records exploitation.

Who is affected

The affected products and version ranges are:

• iOS and iPadOS: before 26.7.1
• macOS: before 15.8.1 and before 26.7.1

The fixed releases named by Apple are iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. If your organisation manages iPhones, iPads or Macs, treat devices below those builds as affected.

What to do now

1. Apply Apple's fixed releases: iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.
2. Prioritise users who may be more likely to be targeted, because Apple describes the exploitation as an extremely sophisticated attack against specific targeted individuals.
3. For devices that cannot be updated, follow CISA's KEV required action: apply any vendor mitigations or discontinue use of the product if mitigations are unavailable. CISA's due date is 2 October 2026, and the required action references BOD 26-04 prioritisation and forensics triage requirements.
4. Verify update deployment through MDM or asset inventory; do not rely on user self-reporting.

Beyond the patch

Because Apple and CISA both record exploitation, detection and response are the immediate companion to patching. Managed Detection & Response provides endpoint monitoring for signs of post-exploitation activity, and an Incident Response Retainer keeps a known response path if a device is confirmed affected.