CVE-2026-20700
CVE-2026-86950 · CVE-2026-86987 · CVE-2026-86990Apple operating system flaws let attackers execute code, steal data, access cameras
Apple's operating systems have several vulnerabilities: a memory corruption issue and an out-of-bounds write could let an attacker run arbitrary code, an authorization flaw could let a remote attacker access sensitive user data, and an access issue could let a malicious app use the camera without permission. They affect iPhones, iPads, Macs, and Apple TV, visionOS, and watchOS devices. Apple has released fixes across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS; two of the flaws are on CISA's known-exploited list, meaning they are being actively exploited in targeted attacks.
Apple Multiple Products · Updated 28 Oct · From 4 of our stories and the public records
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| iOS and iPadOS 27.2 | 27.2 |
| macOS 27.2 | 27.2 |
| visionOS 27.2 | 27.2 |
| iOS and iPadOS 26.7 | 26.7.1 |
What to do
- Update each affected Apple device to the fixed version: for iPhones/iPads use iOS/iPadOS 18.7.11, 26.7.1, 26.7.2, or 27.2; for Macs use macOS Sequoia 15.8.1, Tahoe 26.3/26.7.1/26.7.2, or Golden Gate 27.2; for Apple TV, visionOS, and watchOS use the corresponding 26.3 or 27.2 updates.
- Prioritize the two known-exploited vulnerabilities: CISA says attackers are using them, and U.S. federal agencies must patch by 2026-03-05 and 2026-10-13.
- On older iPhones and iPads, install the backported CoreGraphics fix that Apple released on 2026-10-27.
What happened
- 12 FebCISA added CVE-2026-20700 to its known-exploited vulnerabilities list and required U.S. federal agencies to fix it by 2026-03-05.
- 29 SeptApple disclosed that CVE-2026-86950, an out-of-bounds write in CoreGraphics, was exploited in extremely sophisticated targeted attacks on iOS versions before 27.
- 29 SeptCISA added CVE-2026-86950 to its known-exploited list and required U.S. federal agencies to fix it by 2026-10-13.
- 26 OctApple released a broad set of security updates addressing 329 vulnerabilities, including a camera access flaw and an Apple Intelligence data-access flaw.
- 27 OctApple backported the CoreGraphics zero-day fix to older iPhones and iPads.
The 4 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-20700 | Apple Multiple Buffer Overflow Vulnerability | high 7.8 | 12 Feb | 1.7% |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability | high 8.8 | 29 Sept | 26% |
| CVE-2026-86987 | An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access … | — | No | 0.2% |
| CVE-2026-86990 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 a… | — | No | 0.3% |