Apple has released emergency security updates for iOS and macOS , patching a critical zero-day vulnerability that was reportedly exploited in targeted attacks against specific individuals. The vulnerability, known as CVE-2026-86950 , was discovered by the Meta security team and concerns a serious issue in the CoreGraphics component of the operating system. Apple described the attack as “ highly sophisticated ,” suggesting the involvement of advanced state or criminal actors.
See also: CVE-2026-76461: Critical zero-day in Cisco Secure Email Gateway
CVE -2026-86950 is technically classified as an out-of-bounds write vulnerability — a class of memory errors that allows an attacker to write data outside the bounds of a buffer, resulting in arbitrary code execution.Specifically, the vulnerability is triggered when the system processes a specially crafted file through CoreGraphics, the subsystem responsible for rendering 2D graphics and PDF files across Apple. This means that the malicious file could reach the victim via web pages, email attachments, or messaging apps.
Of particular concern is the potential for zero-click exploitation — that is, exploitation without any action from the user. Since CoreGraphics automatically handles link and attachment previews in many applications, an attacker could theoretically exploit the vulnerability simply by sending a message — without the user having to click or open anything. This scenario makes the vulnerability particularly dangerous for journalists, activists, and other high-profile individuals who are common targets of state espionage.
CVE-2026-86950: What we know about the CoreGraphics vulnerability
Apple confirmed in its official advisory that it is “ aware of a report that this issue may have been exploited in a highly sophisticated attack against specific targeted individuals in iOS versions prior to iOS 27. ” The company did not disclose details about the number of victims, the identity of the attackers, or the geographic distribution of the attacks. However, the use of the phrase “highly sophisticated” is indicative — Apple typically uses this wording to imply spyware or government espionage-type attacks.
Meta ’s involvement in discovering the vulnerability is notable . Meta ’s product security team reported CVE-2026-86950 to Apple , which echoes a similar incident last year. At the time, WhatsApp had revealed that a vulnerability in its iOS and macOS apps ( CVE-2025-55177 ) was likely used in conjunction with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks targeting fewer than 200 users . The fact that Meta again found such a vulnerability suggests that the company has sophisticated threat detection systems that actively monitor its platforms for signs of exploitation.
It remains unclear whether the new CoreGraphics was exploited through WhatsApp or another application.
See also: Meta patches Muse zero-day vulnerability
CVE-2026-86950: Which devices are affected and how to protect yourself
Apple has released fixes for CVE-2026-86950 with the following updates: iOS 26.7.1 , iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 . While both iOS and macOS are affected by the vulnerability, Apple 's advisory indicates that attacks have only been observed on iOS devices . The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
Users should update their devices immediately. To install the update on an iPhone or iPad, go to Settings → General → Software Update. On a Mac, open System Preferences → General → Software Update. Given the nature of the vulnerability — which could potentially allow zero-click exploitation — installing the update immediately is imperative, especially for users who consider themselves at high risk.
The Cybersecurity and Infrastructure Security Agency ( CISA ) has yet to add CVE-2026-86950 to its list of Known Exploitable Vulnerabilities ( KEV ). If it does, it would be the ninth Apple product vulnerability added to the list this year — a number that highlights the continued targeting of the Apple ecosystem by advanced threat actors.
CVE-2026-86950 and the broader context of zero-day attacks on Apple
The discovery of CVE-2026-86950 is part of a broader pattern of targeted attacks against Apple device users . In recent years, spyware tools like NSO Group ’s Pegasus have repeatedly exploited zero-day vulnerabilities in iOS to spy on journalists, activists, politicians, and businesspeople. Apple has invested heavily in the security of its platform, introducing features like Lockdown Mode for high-risk users, but attackers continue to find new vulnerabilities.
The frequency with which zero-day vulnerabilities are being discovered in CoreGraphics and other fundamental components of iOS highlights the complexity of securing a modern operating system. CoreGraphics, as a core component that handles graphics and PDF files, is an attractive target because it interacts with countless applications and can be triggered by external content without explicit user action. This makes it an ideal vector for zero-click attacks.
For users in Greece and Europe, the threat is just as real. There have been cases of spyware against Greek journalists and politicians, while the GDPR and the European NIS2 impose increased obligations on organizations to protect their systems. Promptly applying security updates is not just good practice — it is a legal obligation for many businesses.
See also: Apple fixes WebKit vulnerability in iOS, iPadOS, and macOS
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In summary, CVE-2026-86950 is a stark reminder that even the most secure platforms remain vulnerable to advanced attacks. Meta ’s collaboration with Apple to disclose and patch the vulnerability is a positive example of responsible disclosure in the industry. Users are urged to update their devices immediately, enable automatic updates, and — if they are in high-risk groups — consider using Apple ’s Lockdown Mode for additional protection.
