Apple CoreGraphics Zero-Day CVE-2026-86950: Fix Now Backported to Older iPhones and iPads

On 26 October 2026 Apple released iOS 18.7.11 and iPadOS 18.7.11, bringing its fix for CVE-2026-86950 to older devices that cannot run newer versions, including iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation. The flaw is an out-of-bounds write in CoreGraphics, the framework Apple's operating systems use to draw graphics and render images. Apple says "processing a maliciously crafted file may lead to arbitrary code execution." Apple first fixed it on 28 September 2026 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Apple describes the exploitation narrowly. In its security notes for iOS 18.7.11, it says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." That is a targeted attack against selected people, not a mass campaign, and Apple has not named victims, attackers or how the file was delivered. CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) catalog on 29 September 2026, with a 13 October 2026 remediation due date for US federal civilian agencies; known ransomware campaign use is listed as "Unknown" (checked 28 October 2026, 08:16 Cyprus time, UTC+2; catalog version 2026.10.27). Apple publishes no CVSS score. CISA's score, shown on NVD, is 8.8 (High).

For most organisations this is a routine but important update: make sure every managed iPhone, iPad and Mac is on a fixed version, including the older devices that are easy to forget.

Technical Information

What Apple has said (iOS 18.7.11 and iPadOS 18.7.11, 26 October 2026; iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, 28 September 2026):

• Component: CoreGraphics.
• Weakness: "An out-of-bounds write issue was addressed with improved bounds checking." CISA classifies it as CWE-787 (out-of-bounds write).
• Impact: "Processing a maliciously crafted file may lead to arbitrary code execution."
• Exploitation: Apple "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Apple does not say how many people were targeted, who was behind it, or which app or file type was used.
• Credit: Apple credits Meta Product Security with reporting the flaw.

Scoring. Apple does not publish CVSS scores. On NVD, the only score is from CISA (as an Authorized Data Publisher): CVSS 3.1 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). "UI:R" means a user has to take some action, such as opening or receiving the crafted file. NVD has not published a score of its own. CISA's SSVC assessment records exploitation as "active" and the flaw as not automatable.

What Apple has not said. Apple's security notes for iOS 27, iOS 27.2, macOS Golden Gate 27 and macOS Golden Gate 27.2 do not list CVE-2026-86950, and Apple does not say whether those versions were ever affected. Apple's statement places the reported exploitation on versions before iOS 27. Apple does not list watchOS, tvOS or visionOS for this CVE, so we do not assume they are affected.

Timeline (Cyprus time; UTC+3 until 25 October, UTC+2 after):

• 28 September 2026: Apple releases iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, each fixing CVE-2026-86950 with the targeted-exploitation note.
• 28 September, 23:17: NVD publishes the CVE record from Apple.
• 29 September: CISA adds CVE-2026-86950 to the KEV catalog, with a due date of 13 October 2026.
• 29 September, 17:29: CISA's SSVC assessment on NVD changes exploitation to "active".
• 26 October: Apple releases iOS 18.7.11 and iPadOS 18.7.11, backporting the fix to older iPhones and iPads.
• 26 October, 23:20: Apple updates the CVE record to add iOS and iPadOS 18.7.11.
• 27 October, 14:29: NVD re-analyses the record. Its status is "Analyzed".
• 28 October, 08:16: The KEV entry is unchanged (catalog version 2026.10.27).

Affected Product Versions

Per Apple's security notes and the NVD record:

Notes:

• Older devices. Apple's security releases page lists iOS 18.7.11 and iPadOS 18.7.11 for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation. The "Available for" line in Apple's 18.7.11 notes also includes iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Those iPads are also covered by the iOS and iPadOS 26.7.1 fix below, so updating them to 26.7.1 or later is enough (Rescana reading of Apple's device lists).
• iOS and iPadOS 26.7.1 covers iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
• Later builds. On 26 October Apple also released iOS and iPadOS 26.7.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2. They come after the fixed versions above, so devices on them are also covered (Rescana reading of Apple's version order).

Workaround and Mitigation

1. Update. Apple has published no workaround; the fix is the update. Move iPhones and iPads to iOS/iPadOS 18.7.11 (older devices) or 26.7.1 or later, and Macs to macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 or later. On iPhone and iPad, go to Settings > General > Software Update; on a Mac, System Settings > General > Software Update. CISA's KEV due date for US federal civilian agencies (13 October 2026) has passed; the deadline binds only those agencies, but CISA encourages all organisations to prioritise KEV-listed flaws.

2. Find the older devices. The 26 October backport matters for devices that cannot move to iOS 26 or 27. Use your mobile device management (MDM) tool to list devices still on iOS or iPadOS 18 below 18.7.11 and push the update, or set a minimum OS version for access to company apps and email (Rescana guidance).

3. Cover devices outside MDM. Remind staff using personal iPhones or iPads for work email or apps to install the update, and consider requiring a minimum OS version through your conditional access policies (Rescana guidance).

4. Keep it proportionate. Apple describes targeted attacks on specific individuals. If you have people who could plausibly be targeted, such as executives, journalists or staff in sensitive roles, make sure their devices are updated first and follow your usual incident process if anything looks wrong (Rescana guidance).

Indicators of Compromise

None published. Apple, CISA and NVD have not released indicators of compromise for CVE-2026-86950.

What we will update

We will update this post if Apple revises its notes (for example with more device details or exploitation information), if CISA changes the KEV entry, if NVD publishes its own score, or if a national CERT publishes an advisory with new detail.

Sources

• Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 (26 October 2026); iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (28 September 2026); Apple security releases
• NIST NVD: CVE-2026-86950 (status "Analyzed"; CISA ADP CVSS 3.1 8.8; no NVD score; checked 28 October 2026, 08:10 Cyprus time, UTC+2)
• CISA: KEV catalog entry for CVE-2026-86950 (added 29 September 2026; due 13 October 2026; known ransomware campaign use "Unknown"; catalog version 2026.10.27, checked 28 October 2026, 08:16 Cyprus time, UTC+2)
• Press (secondary): BleepingComputer, Apple backports CoreGraphics zero-day patches to older iPhones (27 October 2026)

Suppliers reach your data through their staff's phones, tablets and laptops as well as their platforms, so a patched fleet is part of their security posture. For vendor risk, the useful signal is whether suppliers enforce minimum OS versions and apply KEV-listed fixes promptly, including on older devices.

Forward this to your TPRM owner: This does not mean a supplier is compromised; Apple describes targeted attacks on specific individuals. A light check is still reasonable (Rescana guidance). Ask key suppliers:

1. Do you enforce a minimum iOS, iPadOS and macOS version for devices that access our data, and does it now include the fixed versions for CVE-2026-86950?
2. How do you handle older iPhones and iPads that cannot run iOS 26, and personal devices used for work?

Want a fast, evidence-based view of how the vendors in your supply chain keep up with actively exploited flaws like this one? Book a demo.