Apple Patches CVE-2026-86950: CoreGraphics, Targeted Attacks

Apple patched CVE-2026-86950 on September 28. The flaw is in CoreGraphics. CVSS 8.8 (high, per NVD). Apple’s advisory language: “may have been exploited in targeted attacks.” Independent exploitation confirmation: none publicly available as of this writing.

What’s affected

Older supported releases of iOS, iPadOS, and macOS. Apple issued patches for iOS 26, macOS 26, and macOS 15 in the September 28 update. The fix applies to those specific branches. Per SANS Internet Storm Center, not all platform branches received the security fix in this release cycle.

Patches are available via Apple’s standard update channels.

Confidence and status

Apple’s “may have been exploited in targeted attacks” is the company’s standard advisory language when it has reason to believe exploitation has occurred. It is not independent confirmation. Not listed on CISA’s Known Exploited Vulnerabilities catalog as of September 29.

No public CVE details from NVD on attack vector or specific trigger conditions. Source: The Hacker News. Apple advisory: CVE-2026-86950.

Watch for a CISA KEV addition if third-party exploitation confirmation follows.

Related Apple coverage

• Apple Patches 200 Vulns in iOS 27, macOS Golden Gate — September 15 patch cycle
• Apple Patches 27 Flaws in iOS, iPadOS, macOS Tahoe
• MacSync macOS Malware Abuses Public iCloud Calendars