CVE-2026-86950

This is like a booby-trapped letter: if your device opens a specially crafted file, it can let an attacker take full control of the phone, tablet, or computer — read your messages, access your data, or install spyware. It doesn't require you to type a password or click 'allow' beyond opening the file itself.

This matters to you if you or your employees use an iPhone, iPad, or Mac — essentially any Apple device running software older than the fixed versions. Apple has confirmed this was exploited in real, targeted attacks against specific individuals, not just a theoretical risk.

Attackers are already exploiting this flaw in sophisticated, targeted attacks against specific people, and it's officially listed by the U.S. government (CISA) as a known exploited vulnerability with a remediation deadline of October 2, 2026 — which has already passed or is imminent. This is not a wait-and-see situation: update affected Apple devices now.

1. Inventory all Apple endpoints (iPhone, iPad, Mac) in your organization and check OS build/version against the fixed releases. 2. Apply iOS 26.7.1 / iPadOS 26.7.1 for mobile devices, macOS Sequoia 15.8.1 for Sequoia-based Macs, or macOS Tahoe 26.7.1 for Tahoe-based Macs — select the branch matching each device's current OS. 3. No workaround exists other than restricting receipt/processing of untrusted files (e.g., messages, email attachments) from unknown senders until patched, since exploitation requires the device to process a malicious file. 4. This is in CISA's KEV catalog with a remediation due date of 2026-10-02 — treat as overdue/urgent per BOD 26-04 if not yet applied, and document patch status for compliance. 5. Monitor Apple security advisories (support.apple.com/en-us/149226, 149228, 149229) for any follow-up guidance, and watch for signs of compromise on devices belonging to high-risk individuals (executives, legal, finance) given the targeted-attack nature of exploitation reported by Apple.

CVSS 3.1 score 8.8 (High): Network attack vector, low complexity, no privileges required, but user interaction required (processing a crafted file), with high impact to confidentiality, integrity, and availability. Weakness is CWE-787 (Out-of-bounds Write) leading to arbitrary code execution. No public exploit code is known, but exploitation is confirmed in the wild — Apple reports an 'extremely sophisticated attack against specific targeted individuals' on iOS versions prior to iOS 27, and CISA added this to the KEV catalog on 2026-09-29 with a remediation due date of 2026-10-02. Given confirmed active exploitation, EPSS predictive scoring is not the relevant signal here; treat as actively weaponized with limited but highly targeted exploit maturity (nation-state/commercial spyware-grade sophistication implied).