Apple 2026 zero-days
CVE-2026-20700: dyld, Feb 2026, used with WebKit CVE-2025-14174 / -43529.
- Disclosed
What happened
- CVE-2026-86950: CoreGraphics out-of-bounds write, late Sep 2026, reported by Meta. Fixed in iOS 26.7.1, macOS 26.7.1 and 15.8.1, with an iOS 18.7.11 backport.
Live scores
Live scores
CVE-2025-14174- EPSS
- 0.553
very likely to be attacked soon - VEDAS
- 0.984
strong exploit evidence - On CISA KEV
- Yes, since 2025-12-12
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-43529- EPSS
- 0.257
likely to be attacked soon - VEDAS
- 0.973
strong exploit evidence - On CISA KEV
- Yes, since 2025-12-15
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-20700- EPSS
- 0.017
some chance of attack soon - VEDAS
- 0.974
strong exploit evidence - On CISA KEV
- Yes, since 2026-02-12
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-86950- EPSS
- 0.262
likely to be attacked soon - VEDAS
- 0.972
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-29
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://cyberscoop.com/apple-zero-day-vulnerability-cve-2026-20700/
- https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed/
- https://support.apple.com/en-us/100100
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.