Apple released updates to address an actively exploited vulnerability tracked as CVE-2026-86950. The vulnerability affects iOS, iPadOS, macOS Tahoe, and Sequoia. This is an out-of-bounds write flaw that can be exploited by processing a maliciously crafted file. Successful exploitation of the vulnerability may lead to arbitrary code execution. Apple has addressed the vulnerability with improved bounds checking.
Apple mentioned in their advisory that they are aware of a report that the vulnerability may have been exploited in an extremely sophisticated attack against specific individuals on versions of iOS prior to iOS 27.
CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch the vulnerabilities before October 2, 2026.
Affected Products and Versions
- iPhone 11 and later
- iPad 8th generation and later
- iPad Air 3rd generation and later
- iPad mini 5th generation and later
- macOS Tahoe Versions before 26.7.1
- macOS Sequoia Versions before 15.8.1
- iPad Pro 11-inch 1st generation and later
- iPad Pro 12.9-inch 3rd generation and later
Mitigation
Apple released the following versions to patch the vulnerability:
- macOS Tahoe 26.7.1
- macOS Sequoia 15.8.1
- iOS 26.7.1 and iPadOS 26.7.1
For more information, please visit the Apple security advisories for macOS Tahoe, Sequoia, and iOS and iPadOS.
Qualys Detection
Qualys customers can scan their devices with QIDs 388845, 388846, and 610810 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References
https://support.apple.com/en-us/149226
https://support.apple.com/en-us/149228
https://support.apple.com/en-us/149229
