Apple fixes exploited CoreGraphics bug (CVE-2026-86950)

In brief

Apple fixed one memory-corruption bug in CoreGraphics for devices that stay on iOS 26, macOS Tahoe 26 and macOS Sequoia 15, and says it may have been exploited in targeted attacks. Opening or previewing a single crafted file can be enough, so these updates belong at the front of the queue.

Exploited, according to Apple

• CoreGraphics

  CVE-2026-86950Exploited, per Apple

  Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

  CoreGraphics is the framework apps use to draw images and documents, so a file arriving by email, chat or download can reach it without anyone running a program. Apple describes the fix as improved bounds checking for an out-of-bounds write, the kind of bug that lets an attacker run code with the app's privileges.

Who should act

• Any organization with iPhones or iPads on iOS or iPadOS 26, or Macs on macOS Tahoe 26 or macOS Sequoia 15.
• Older iPads that cannot move to iPadOS 27 (Apple lists iPad Pro 12.9-inch 3rd generation, iPad Pro 11-inch 1st generation, iPad Air 3rd generation, iPad 8th generation and iPad mini 5th generation for 26.7.1 but not for 27): 26.7.1 is their fix.
• People who are likely targets of tailored attacks, such as executives, finance and legal staff, and anyone handling sensitive negotiations: update their devices first.

What to do

1. In your device management tool, list every device below iOS or iPadOS 26.7.1 on the 26 line, below macOS 26.7.1 on Tahoe and below macOS 15.8.1 on Sequoia.
2. Push the update with an enforced install deadline (Apple's declarative software update enforcement or your MDM's equivalent) rather than a reminder, and schedule it outside working hours where you can.
3. Start with the high-risk users above, then the rest of the fleet. For people who may be specifically targeted, consider Apple's Lockdown Mode.
4. Devices already on iOS 27 or macOS Golden Gate 27: install 27.0.1 and keep them current. Apple has not listed this CVE for the 27 releases.
5. Re-run the inventory after the deadline and follow up on devices that have not checked in.

What this briefing does not establish

• Apple has not published technical details, the file types involved or indicators of compromise.
• Apple's advisories for iOS 27 and macOS Golden Gate 27 do not list CVE-2026-86950, and Apple's wording places the reported exploitation on versions of iOS before iOS 27. This briefing does not infer whether the 27 releases were ever affected.
• Fortress has not reproduced the issue. This briefing restates Apple's published information and adds operational guidance.

Apple’s advisories

• iOS 26.7.1 and iPadOS 26.7.1 · released September 28, 2026
• macOS Tahoe 26.7.1 · released September 28, 2026
• macOS Sequoia 15.8.1 · released September 28, 2026