High-Risk Remote Code Execution Vulnerability in Apple Products

Redpacketsecurity

High-Risk Remote Code Execution Vulnerability in Apple Products

First seen 29 Sep 2026, 15:40 UTC • •74.0

Article Content

1 / 4

Browse articles

ThreatCluster •September 29, 2026 at 16:22 UTC

•CVE-2026-86950 allows remote code execution on affected Apple devices.
•Exploitation has been confirmed against targeted individuals using outdated iOS versions.
•Patches for affected systems were released on 2026-09-29; immediate application is recommended.

A critical vulnerability, CVE-2026-86950, has been identified in Apple products, allowing remote code execution via maliciously crafted files. This issue affects versions of iOS prior to 26.7.1, iPadOS prior to 26.7.1, macOS Sequoia prior to 15.8.1, and macOS Tahoe prior to 26.7.1. Apple has acknowledged that this vulnerability may have been exploited in sophisticated attacks against targeted individuals. The risk level is rated as high due to the potential for arbitrary code execution, which could lead to data theft or further compromises. Users are advised to apply the patches released on 2026-09-29 promptly. The vulnerability was added to the CISA KEV list on the same day, indicating active exploitation. Organizations with large Apple device fleets are particularly at risk, especially those handling sensitive information.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 1h ago How this analysis works

Timeline

2026-09-28

CVE-2026-86950 published

Apple disclosed a critical vulnerability affecting multiple versions of its operating systems.

Redpacketsecurity

2026-09-29

CISA KEV listing

CVE-2026-86950 was added to the CISA KEV catalog, indicating active exploitation in the wild.

2026-09-29

Patches released

Apple released updates for iOS, iPadOS, and macOS to address the vulnerability.

More articles in this cluster (3)

Threat Graph

10 entities, 15 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Remote Code Execution
Zero-day Exploit
T1203 - Exploitation for Client Execution

Organization (1)

Apple

Vulnerability (1)

CVE-2026-86950

Weakness (2)

Cwe-787 - Out-of-bounds Write
CWE-94 - Code Injection

Affected Platform (3)

IOS
IPadOS
MacOS

Relationships

CVE-2026-86950 targets IOS
CVE-2026-86950 targets IPadOS
CVE-2026-86950 targets MacOS
Remote Code Execution targets IOS
Remote Code Execution targets IPadOS
Remote Code Execution targets MacOS
Zero-day Exploit targets IOS
Zero-day Exploit targets IPadOS
Zero-day Exploit targets MacOS
T1203 - Exploitation for Client Execution targets IOS
T1203 - Exploitation for Client Execution targets IPadOS
T1203 - Exploitation for Client Execution targets MacOS
CVE-2026-86950 related to Apple
CVE-2026-86950 related to Cwe-787 - Out-of-bounds Write
CVE-2026-86950 related to CWE-94 - Code Injection

Following this threat?

Track Apple and CVE-2026-86950 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks Apple has released security updates for iOS and macOS to address a zero-day vulnerability, CVE-2026-86950, in the CoreGraphics component. This out-of-bounds write flaw can allow arbitrary code execution when processing specially crafted files. The vulnerability has reportedly been exploited in targeted attacks against…

ShinyHunters Escalate Oracle PeopleSoft Exploitation Amid Microsoft Mega-Patch ShinyHunters, a hacking group, has escalated attacks exploiting Oracle PeopleSoft vulnerability CVE-2026-35273 following the arrest of a member in the Netherlands. This vulnerability, with a CVSS score of 9.8, is being exploited using URL-encoding techniques to bypass web application firewalls. Microsoft recently…