Apple backports fix for exploited CoreGraphics zero-day CVE-2026-86950 to older iPhones and iPads
Apple backported the fix for exploited CoreGraphics flaw CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11 for older iPhones and iPads.
- Published
- Updated
- Ecosystem
- Desktops, browsers and mobile
- Fixed in
- iOS 18.7.11, iPadOS 18.7.11, iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2
- Exploitation
- Yes, Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27
Live scores
CVE-2026-86950- EPSS
- 0.262
likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-29
- Detection rule
- None yet
Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-65339- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-86990- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-86987- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
What happened
Apple backported a fix for a high-severity flaw that was exploited in real-world attacks to older devices. The Hacker News reported that the flaw is CVE-2026-86950 (CVSS 8.8), an out-of-bounds write in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution. Malwarebytes describes CoreGraphics as Apple’s framework for drawing graphics, images and PDF content.
Apple’s own wording, quoted by both outlets, is that it “is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Malwarebytes reads this as Apple believing the bug was used against a limited group of users, and notes that such targets are usually journalists, activists and officials.
The Hacker News says the fix first shipped last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The backport arrived on October 26, according to Malwarebytes, in iOS 18.7.11 and iPadOS 18.7.11. Malwarebytes calls this a backport: a fix from a newer software version brought to an older one, so devices that cannot run iOS 26 are protected without upgrading to an unsupported operating system.
The same iOS 18.7.11 and iPadOS 18.7.11 release also fixes two other issues, according to The Hacker News:
- CVE-2026-65339: a logic issue in Audio that an app could use to leak sensitive user information.
- CVE-2026-86990: an access vulnerability in CoreMedia that a malicious app could abuse to access the camera without user permission.
Apple also shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. The Hacker News says these fix hundreds of vulnerabilities, including an authorization issue in Apple Intelligence (CVE-2026-86987) that a remote attacker could exploit to access sensitive user data. The outlet notes Apple makes no mention of any of those other flaws being exploited in the wild.
The NVD page for CVE-2026-86950 was supplied as a source, but the text provided contained no record details, so the facts above come from the two news reports. Technical details beyond what is listed (exploit chain, delivery method, attacker identity) are not confirmed.
Am I affected?
- Devices that cannot run iOS 26 are the focus of the backport. Both outlets list the iPhone XS, iPhone XS Max, iPhone XR and the 7th generation iPad as receiving iOS 18.7.11 or iPadOS 18.7.11. The Hacker News also lists some newer iPad models (iPad Air 4th generation and later, iPad 9th generation and later, iPad mini 6th generation and later). Malwarebytes lists those under iOS 27.2 and iPadOS 27.2 instead, so check Apple’s own update list for your exact model.
- Apple’s exploitation statement covers devices running versions of iOS before iOS 27.
- Macs running macOS Tahoe or macOS Sequoia are also in scope. The fix first shipped in macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 per The Hacker News. Malwarebytes’ update table lists macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2 as the current releases.
- Whether Apple’s other platforms (tvOS, watchOS, visionOS) are affected by CVE-2026-86950 is not confirmed in the sources.
- Targeted individuals such as journalists, activists and officials face the highest risk, according to Malwarebytes.
What to do now
- On iPhone or iPad, go to Settings > General > Software Update and install the latest available release for your model: iOS 18.7.11 or iPadOS 18.7.11 for older devices, or iOS 27.2, iPadOS 27.2 or iOS 26.7.2, iPadOS 26.7.2 where your model supports them (per Malwarebytes’ table).
- Turn on Automatic Updates on the same Software Update screen if it is not already enabled.
- On a Mac, open Apple menu > System Settings > General > Software Update and install the latest macOS release. Safari updates ship with macOS updates.
- If you could be a target of highly sophisticated spyware, update, restart your phone, and consider enabling Apple’s Lockdown Mode, as Malwarebytes advises.
- For managed fleets, inventory devices that are stuck on iOS 18 (iPhone XS, XS Max, XR, 7th generation iPad) and prioritize them for iOS 18.7.11 or iPadOS 18.7.11.
- Check Apple’s security release notes for your exact model and OS, because the two news reports differ on which iPad models get which update.