Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.

Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.

The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics. The vulnerability affects a broad range of Apple devices, including iPhones dating back to the iPhone 11 and multiple generations of iPads.

Extremely Sophisticated Attacks

The flaw has a CVSS score of 8.8 and can allow an attacker to execute arbitrary code on an affected system. According to Apple's advisory , the vulnerability is being exploited "in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27. The technology giant said it has addressed the vulnerability by adding checks to ensure the software does not write data beyond the memory allocated for it.

Related: AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) catalog — a source that it wants organizations to use to prioritize patching efforts . In keeping with its binding operative directive (BOD 26-04) from earlier this year for high-priority vulnerabilities, CISA has given federal civilian executive branch agencies three days to apply Apple's recommended mitigation for the vulnerability. As per BOD 26-04, these agencies must also conduct a forensic triage by Oct. 2 to determine if they have already been compromised via CVE-2026-86950.

Apple credited Meta with disclosing the vulnerability to the company but has not released any information on the exploit activity or who it might be targeting.

Adam Bynton, enterprise security manager at Jamf, says CVE-2026-86950 is significant because it affects a component of the graphics stack used to process content across Apple's operating systems. Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.

“The broader pattern is worth watching," he says. "We continue to see highly sophisticated attacks look for routes through components that process untrusted content." As an example, he pointed to CVE-2025-55177 , a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300 , another out-of-bounds zero-day vulnerability, this time in Apple's ImageIQ technology.

"We have also seen Apple disclose targeted exploitation involving WebKit and other memory-safety vulnerabilities," Boynton says.

Related: SectopRAT Returns, Hiding Inside a Legitimate Application

That shouldn’t be interpreted as Apple devices being broadly insecure, he says. "Apple describes these attacks as highly sophisticated and targeted at a very small population, which is why separating targeted exploitation from everyday enterprise risk is important.”

Is a Nation-State Actor Behind the Attacks?

It's unclear who is exploiting CVE-2026-86950 and if the attacks are ongoing. But Apple's description of the attacks as being extremely sophisticated hints that a nation-state actor or spyware firm might be involved. WhatsApp, for instance, has previously accused Israel's NSO Group of using its servers to distribute its Pegasus spyware on mobile devices belonging to targeted individuals.

Ensar Seker, chief information security officer at SOCRadar, says a memory-corruption vulnerability like CVE-2026-86950, which can lead to arbitrary code execution during file processing, creates the potential for a low-interaction or potentially zero-click attack chain when combined with an appropriate delivery mechanism.

The other important detail is Apple's description of the exploitation as an "extremely sophisticated attack" against specific individuals, he says. "That language generally points toward highly targeted operations rather than broad cybercrime," he adds. "Organizations should therefore treat this less like a theoretical vulnerability and more like an indication that advanced threat actors continue to invest heavily in finding ways around Apple's security architecture."

Related: 3 Cyber Threats That Defined the Summer of 2026

The trend is not simply that Apple has more vulnerabilities, Seker continues. What stands out is the continued discovery of flaws being used in sophisticated exploit chains targeting devices that many organizations have traditionally viewed as lower-risk endpoints.

"Over the past year, we have seen exploited vulnerabilities involving WebKit, media and image processing, privilege escalation, authorization controls, and memory corruption," Seker says. "Attackers are increasingly looking for chains rather than a single vulnerability: One flaw provides initial code execution, another escapes a sandbox or increases privileges, and additional components establish access to sensitive information."

The fact that Apple devices are strategically important endpoints at many enterprises, and many high-value targets frequently use iPhones and Macs, also makes the economics of developing exploits targeting Apple vulnerabilities more attractive. The first priority for organizations therefore is to reduce patch latency for Apple products. "When Apple identifies active exploitation, security teams should treat the update as an emergency security patch rather than waiting for the normal monthly patching cycle," Seker says.Organizations should also bring Apple devices fully into their enterprise security program and stop treating them as inherently secure endpoints simply because of Apple's security architecture. "Enterprises need centralized device management, enforced OS minimum versions, rapid update policies, visibility into device compliance, and controls that prevent outdated devices from accessing sensitive corporate resources," he says.

Illinois-based Jai Vijayan is a veteran, award-winning technology journalist with more than 25 years of experience covering cybersecurity. His information security reporting has explored everything from ransomware, nation-state threats, and identity security to AI risk, critical infrastructure protection, software supply chain security, cloud security and emerging enterprise technologies.

Over the course of his career, Jai has written news stories, feature articles, survey reports, white papers, and e-books for enterprise and technology audiences. He has also moderated panel discussions and executive roundtables featuring CISOs, security researchers, and industry leaders.

Jai previously served as senior editor at Computerworld, where he covered information security and data-privacy issues. His work has also appeared in CSO Online, InformationWeek, The Christian Science Monitor Passcode, The Economic Times, and other publications.

His work has earned multiple industry honors, including a Joint ASBPE Excellence Award for Best Coverage of Government IT, and a Joint Jesse H. Neal Award for wireless LAN security coverage. Jai holds a Master’s degree in statistics from Bangalore University, and studied broadcasting and electronic communication at Marquette University in Milwaukee.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Essential News & Insights from Black Hat USA 2025

Effective Alert Triage: Reducing Noise and Finding Real Threats

Effective Alert Triage: Reducing Noise and Finding Real Threats

Cybersecurity Outlook 2027

Cybersecurity Outlook 2027

Threat Exposure Analytics: Measuring and Communicating Security Risk

Threat Exposure Analytics: Measuring and Communicating Security Risk

Benchmark Scores Are a False Flag

Benchmark Scores Are a False Flag

Building an Effective Red Team: Beyond Penetration Testing

Building an Effective Red Team: Beyond Penetration Testing

Operation DoppelBrand: Weaponizing Fortune 500 Brands

CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

Deja Vu: Salesforce Customers Hacked Again, Via Gainsight

Jaguar Land Rover Shows Cyberattacks Mean (Bad) Business