Apple patches 304 flaws including exploited CoreGraphics CVE-2026-86950

1. Executive summary

Apple's October 2026 updates address 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari. The release extends coverage for CVE-2026-86950 to iOS 18.7.11: this CoreGraphics out-of-bounds write has a CVSS score of 8.8 HIGH, an EPSS probability of 26%, and is in CISA KEV, added on 29 September 2026. Of the other nine prioritised CVEs, CVE-2022-26704 is 7.8 HIGH, CVE-2026-112415 is 6.5 MEDIUM and CVE-2026-28864 is 3.3 LOW; the remaining six have unknown CVSS scores, and none of the nine is in CISA KEV. EMEA financial services firms should treat unpatched iOS 18 devices as the immediate exposure, while deploying the full platform updates to address local privilege escalation, privacy bypass, memory corruption and denial-of-service flaws.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

Prioritised triage

CISA KEV status takes precedence, followed by available EPSS data. The table covers the ten CVEs for which NVD, EPSS or CISA KEV status is available in this assessment.

The remaining fixes are distributed through the same platform updates. They include flaws affecting kernel components, WebKit, ImageIO, Gatekeeper, sandbox controls, Remote Management, Screen Sharing, storage components and media parsers. No additional vulnerability in the October release is identified as exploited.

Confirmed attack chain for CVE-2026-86950

1. A device running an affected iOS version processes a maliciously crafted file through CoreGraphics. CoreGraphics handles visual content including images and PDFs, but the exploit file type and delivery method have not been disclosed.
2. File processing triggers an out-of-bounds write, classified as CWE-787. The write can alter memory outside the intended allocation. Apple corrected the condition through improved bounds checking.
3. Successful exploitation can execute attacker-controlled code in the affected process. Neither the resulting process privileges nor any subsequent exploit stage has been disclosed.

CISA KEV lists CVE-2026-86950 as exploited, with an addition date of 29 September 2026. SANS describes the flaw as already exploited, while Apple's relayed wording says it may have been exploited against specific targeted individuals. Apple credited Meta Product Security with reporting the vulnerability. No actor, malware family, campaign, delivery infrastructure or victim identity has been disclosed, so attribution is unconfirmed.

The October update supplies the CVE-2026-86950 correction for iOS 18 through iOS 18.7.11. Earlier corrections were released in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. SANS reported that iOS and macOS 27 were not affected by this vulnerability.

CVE-2022-26704 is a separate Spotlight privilege-escalation issue. An application already executing on an affected device may gain elevated privileges. The available reporting does not specify the vulnerable operation, required user interaction or resulting privilege level. It has a CVSS score of 7.8 HIGH, an EPSS probability of 1%, and is not in CISA KEV.

CVE-2026-112415 is an AppleAVD out-of-bounds write that may terminate the system or corrupt process memory. It has a CVSS score of 6.5 MEDIUM and is not in CISA KEV. No working exploit, delivery method or evidence of exploitation is provided.

No source describes persistence, privilege escalation following CVE-2026-86950, command-and-control, lateral movement, data access, exfiltration or an installed payload. The October CVE-to-product mapping is single-sourced to SANS; verify before enforcement against the update presented by Apple Software Update.

4. Mitigation & containment

P1 within 24h

• Deploy iOS 18.7.11 to every supported iPhone or iPad remaining on the iOS 18 branch. This release supplies that branch's correction for exploited CVE-2026-86950.
• Confirm that iOS and iPadOS 26 devices run at least 26.7.1, and that macOS Tahoe and Sequoia devices run at least 26.7.1 and 15.8.1 respectively. Prefer the current 26.7.2 and 15.8.2 releases.
• Use existing mobile-device compliance controls to block unpatched iOS versions before 27 from corporate applications and data. Isolate high-risk devices that cannot be updated, particularly devices assigned to executives, security personnel or staff exposed to targeted collection.
• Do not treat a device crash or suspicious file alone as proof of exploitation. Preserve the file and device diagnostics for analysis because no public exploit artefacts or indicators are available.

P2 within 72h

• Deploy the current platform releases applicable to each asset: iOS and iPadOS 27.2, 26.7.2 or 18.7.11; macOS Golden Gate 27.2; macOS Tahoe 26.7.2; macOS Sequoia 15.8.2; tvOS 27.2; watchOS 27.2; visionOS 27.2; and Safari 27.2.
• Prioritise devices affected by CVE-2022-26704 and CVE-2026-112415 after closing the CVE-2026-86950 gap. The first permits application privilege escalation, while the second can corrupt AppleAVD process memory.
• Update through Apple Software Update or the organisation's managed software-update policy. The affected frameworks are operating-system components, so component-level replacement or version pinning is not an adequate fix.
• Disable Remote Management and Screen Sharing on Macs that cannot receive the October updates unless those services are required and access is restricted by an existing trusted network control. The release includes multiple flaws in those services, including remote code execution, memory corruption and unauthorised file operations.

P3 within 7 days

• Verify installed versions through the endpoint and mobile-device inventory, then record devices that remain below the required release. Do not rely only on an update command being issued.
• Review failed update deployments, unsupported hardware and business applications that prevent migration. Where compatibility permits, move older iOS and macOS branches to version 27, which SANS reported was not affected by CVE-2026-86950.
• Review available device diagnostics for unexplained CoreGraphics-related process crashes associated with recently received files. This is a low-confidence hunting measure, not a confirmed detection method.
• Confirm that automatic updates are enabled on managed devices where organisational change controls allow them.

5. Indicators of compromise

No indicators of compromise available in the source material.

The October CVE-to-product mapping is single-sourced to SANS; verify before enforcement. The sources provide no hashes, domains, IP addresses, URLs, email addresses, file paths or other atomic indicators tied to exploitation.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

10 referenced CVEs — 1 actively exploited (CISA KEV)

7. Sources

• SANS Internet Storm Center, “Apple Patches for October 2026”, https://isc.sans.edu/diary/rss/33458, 26 October 2026.
• SANS Internet Storm Center, “Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950)”, https://isc.sans.edu/diary/rss/33376, 28 September 2026.
• Malwarebytes Labs, “Update your iPhone, iPad, or Mac: Flaw could run attackers’ code”, https://www.malwarebytes.com/blog/bugs/2026/09/update-your-iphone-ipad-or-mac-flaw-could-run-attackers-code, September 2026.
• Help Net Security, “Apple squashes zero-day bug exploited in ‘extremely sophisticated’ attack (CVE-2026-86950)”, https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed/, 29 September 2026.

8. Adverse Trace position

We assess this patch cycle as high priority because CVE-2026-86950 is a CVSS 8.8 HIGH vulnerability with a 26% EPSS probability and is in CISA KEV, added on 29 September 2026. CVE-2022-26704 is 7.8 HIGH, CVE-2026-112415 is 6.5 MEDIUM and CVE-2026-28864 is 3.3 LOW; CVSS scores for CVE-2026-86990, CVE-2026-112410, CVE-2026-112413, CVE-2026-112414, CVE-2026-112416 and CVE-2026-112417 are unknown. These nine CVEs are not in CISA KEV. Client exposure is highest where iOS 18 devices have not received 18.7.11 or earlier iOS 26 and macOS branches missed the September correction. The October release mapping is single-sourced to SANS; verify before enforcement. We will monitor for exploit artefacts, technical details and changes to CISA KEV status, and will issue an update if material detection or attribution data becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.