CVE-2026-86950: critical Apple flaw exploited in targeted attacks

CVE-2026-86950 concerns an out-of-bounds write issue in Apple operating systems, addressed with improved bounds checking. According to the official NVD description, processing a maliciously crafted file may lead to arbitrary code execution, affecting iOS, iPadOS and macOS in versions prior to the available patches.

The CVSS score is 8.8, in the high severity range. NVD also notes that Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals, on versions of iOS before iOS 27; it is not stated whether exploitation is confirmed more broadly or limited to this single reported case. No public repositories claiming to contain exploits for this vulnerability were found. A limited volume of social media discussion was also observed, indicating some interest but without verifiable technical content.

Organizations should prioritize applying the available updates across their entire Apple device fleet, including versions for iOS, iPadOS, macOS Sequoia and macOS Tahoe. It is advisable to verify that corporate devices managed via MDM receive and install the update, and to pay particular attention to devices used by high-risk individuals (executives, exposed personnel), consistent with the targeted nature of the attack reported by Apple.