Apple has issued a security update designed to fix a zero-day vulnerability which it claimed may have been exploited in an “extremely sophisticated” attack.
In a bulletin on September 28, the tech giant attributed the discovery of CVE-2026-86950 to the Meta Product Security team.
“Processing a maliciously crafted file may lead to arbitrary code execution,” it said of the flaw.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Read more on Apple zero days: Apple Patches Two Zero-Days Exploited in the Wild
Apple said the vulnerability affects the CoreGraphics rendering framework in iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 are also thought to be affected.
Cobalt CISO, Andrew Obadiaru, argued that security leaders should use the security warning to revisit device governance, especially for senior executives who often get exceptions from standard policy.
“I'd encourage teams to use this as a prompt to review three things,” he said.
“How quickly can you enforce a mobile OS update across your fleet, and who is allowed to defer it? Do you have a defined list of high-risk individuals with stronger device protections enabled? And if one of those phones were compromised, would your incident response plan know what to do with it? Many IR playbooks still stop at the laptop.”
The Latest in a Long Line of Zero Days
While high-value executives may have been a target for exploitation of this zero day, discoveries in the past have been tied to commercial spyware makers that tout exploits to governments and law enforcement agencies.
In February 2025, for example, researchers at The Citizen Lab found CVE-2025-24200, which Apple said had been exploited “in an extremely sophisticated attack against specific targeted individual.”
Apple this month also patched CVE-2026-86869, a critical zero-click vulnerability which could have been silently triggered via a maliciously crafted iMessage. It appears that this one was found and reported to the iPhone giant before malicious researchers had a chance to discover and monetize/weaponize it.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.