Grade One Press

Technology reporting you can check

News · Security & privacy

Apple fixed an exploited flaw in iPhones, iPads and Macs, and US agencies were given until 2 October to patch

Apple says it may have been used in an extremely sophisticated attack on specific people. The US cyber agency listed it as exploited a day after the fix.

Grade One Newsroom · 1 min read

Sources: 5 · top grade 1How evidence is graded

Apple fixed a flaw in iPhones, iPads and Macs that may have been used in targeted attacks

Grade 3 · Filed record

Source: Apple

What changed
Apple fixed CVE-2026-86950, in its CoreGraphics component, on 28 September. CISA listed it as exploited on 29 September and gave US agencies until 2 October.
Who it affects
People and organisations using iPhone 11 or later, recent iPads, or Macs on macOS Tahoe or Sequoia, until they install the 28 September updates.
What it does not tell you
Who was attacked, by whom, or how many. Apple says only that it is aware of a report of an attack on specific targeted individuals.

The full story Check the source

Apple fixed a flaw in iPhones, iPads and Macs on 28 September that it says may have been exploited. The fix is in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 [3][4][5].

The flaw, CVE-2026-86950, is an out-of-bounds write in Apple's CoreGraphics component. Processing a maliciously crafted file may let an attacker run code [2][3].

Apple says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" [3].

The next day, 29 September, the US Cybersecurity and Infrastructure Security Agency added the flaw to its catalogue of exploited vulnerabilities. Federal agencies have until 2 October to act, and must check for signs of compromise [1].

In NIST's database, CISA scores it 8.8 out of 10, rated high [2].

What it covers

iPhone 11 and later, and iPads from the iPad Pro (third-generation 12.9-inch and first-generation 11-inch), iPad Air (third generation), iPad (eighth generation) and iPad mini (fifth generation) onwards [3].

Macs running macOS Tahoe or macOS Sequoia [4][5].

Apple credits the report to Meta's product security team [3].

CISA's deadline binds US federal agencies. For everyone else, the fix is the 28 September update [1][3].

What it does not tell you

Who was attacked, by whom, or how many people. Apple describes only an attack on specific targeted individuals, and CISA does not say more [1][3].

Whether the attack worked on iOS 27. Apple's wording refers to versions before it [3].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entry CVE-2026-86950. Read 29 September 2026. Grade 1 · Primary Added 29 September 2026, due 2 October, with forensic triage required. A listing means CISA has evidence of exploitation.
  2. US National Vulnerability Database (NIST), CVE-2026-86950. Read 29 September 2026. Grade 1 · Primary Published 28 September 2026. The 8.8 score was added by CISA; NIST has not scored it separately.
  3. Apple, About the security content of iOS 26.7.1 and iPadOS 26.7.1. Read 29 September 2026. Grade 3 · Filed record Apple's own advisory, released 28 September 2026. Lists the devices covered and credits the report.
  4. Apple, About the security content of macOS Tahoe 26.7.1. Read 29 September 2026. Grade 3 · Filed record Released 28 September 2026.
  5. Apple, About the security content of macOS Sequoia 15.8.1. Read 29 September 2026. Grade 3 · Filed record Released 28 September 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Privacy Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all