Apple CoreGraphics zero-day added to KEV — CVE-2026-86950, report of exploitation in an extremely sophisticated targeted attack (Due October 2)
On September 28, 2026, Apple released iOS 26.7.1 / iPadOS 26.7.1 / macOS Tahoe 26.7.1 / macOS Sequoia 15.8.1, fixing an out-of-bounds write (CVE-2026-86950, CWE-787) in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution; Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. CISA added the vulnerability to KEV on September 29, 2026, with a federal due date of October 2 (forensicTriage Yes). The CISA-ADP CVSS 3.1 base is 8.8 (High). The fix is the listed releases only; the primary sources reviewed for this post state no interim workaround.
Isi artikel ora ana ing basa iki; basa Inggris sing ditampilake.
On September 28, 2026, Apple released iOS 26.7.1 and iPadOS 26.7.1, along with macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, and published the CoreGraphics security content for those releases (Apple support documents 149226 / 149228 / 149229, all published 2026-09-28). CVE-2026-86950 is described as: "An out-of-bounds write issue was addressed with improved bounds checking." The stated impact: "Processing a maliciously crafted file may lead to arbitrary code execution." Apple adds: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Apple's release notes do not state a delivery channel or further exploitation detail. The CISA KEV short description for the entry reads "Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution" (CISA KEV catalog). The NVD record for CVE-2026-86950 states the fix is in "iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1"; the CISA-ADP CVSS 3.1 base is 8.8 (HIGH, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the weakness class is CWE-787 (Out-of-bounds Write); and the SSVC data records exploitation as active. The KEV notes list the Apple document URLs, the NVD CVE record, and references to BOD 26-04 and the CISA Forensics Triage Requirements.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 29, 2026, with a federal due date of October 2 (BOD 26-04, three days after listing). The KEV notes require applying vendor-directed mitigations in line with BOD 26-04 and the CISA Forensics Triage Requirements; forensicTriage is Yes and known ransomware campaign use is Unknown. In the CISA KEV catalog (1,734 entries at the time of this post), this entry was added after F5 BIG-IP APM (CVE-2026-94127), MikroTik RouterOS (CVE-2026-67279), Microsoft SharePoint (CVE-2026-65660), WordPress Core (CVE-2026-87902), Citrix NetScaler (CVE-2026-88772 / CVE-2026-88771), and Cisco Catalyst SD-WAN Manager (CVE-2026-76504), extending the late-September wave from edge devices and management interfaces to an endpoint operating system component. As of this writing (2026-10-08), this Apple CoreGraphics entry is the most recent addition in that window.
Analysis (kept separate from the reporting): the point worth noting is that the trigger is file input processed by CoreGraphics. Web pages, email attachments, and messaging applications are all plausible channels, but Apple does not attribute a delivery channel in the primary sources reviewed for this post, which is consistent with the CVSS vector marking user interaction as required (UI:R). Apple's phrasing — "versions of iOS before iOS 27" and "specific targeted individuals" — points to a targeted campaign rather than a mass-exposure remote attack; the primary sources do not state a scale or scope. Because the fix is an operating system update, the enterprise task is visibility into adoption across managed and unmanaged devices, and identifying the environments that have now passed the October 2 deadline. This post does not count KEV entries as a product-wide total.
Implications for defenders: (1) Upgrade to iOS / iPadOS 26.7.1 or later, and macOS Sequoia 15.8.1 / Tahoe 26.7.1 or later, prioritizing devices that have not yet updated. Confirm the Apple software update is applied on each device (Settings > General > Software Update on iOS/iPadOS; System Settings > Software Update on macOS). (2) In MDM-managed fleets, produce an adoption report and a list of non-compliant devices this week; flag anything still unpatched past the October 2 deadline. (3) As an interim measure until updates land, advise users to be cautious with unfamiliar attachments and links, and to avoid previewing files of unknown origin that CoreGraphics processes (images, document previews, etc.). Apple does not state a specific interim workaround in the primary sources reviewed. (4) In a targeted-attack context, with email and web as candidate intake channels, review device sign-in, screen-sharing, and file-access records. The facts come from the Apple release documents (https://support.apple.com/en-us/149226, https://support.apple.com/en-us/149228, https://support.apple.com/en-us/149229), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and the NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-86950). The analysis is described separately from the facts.