macOS and iOS October 2026 security updates: exploited CoreGraphics flaw CVE-2026-86950, versions to install

The short answer: on 26 October 2026 Apple released security updates for macOS, iOS, iPadOS, Safari, watchOS, tvOS and visionOS. The most urgent item is CVE-2026-86950, a flaw in the CoreGraphics component that allows code execution when a malicious file is processed. Apple reports that it may have been exploited in targeted attacks, and CISA has added it to its catalogue of exploited vulnerabilities. Install macOS Tahoe 26.7.2, macOS Sequoia 15.8.2 or macOS Golden Gate 27.2, and iOS or iPadOS 18.7.11, 26.7.2 or 27.2 depending on the device, then check the version actually installed on every computer and phone.

In Morocco, Macs are common in communication agencies, architecture firms and management teams, and iPhones often serve as business phones holding company email and documents. The maCERT of the DGSSI rated this release at a critical risk level in its bulletin of 27 October 2026. Here is what the official sources say and the checks to carry out.

What is affected

The exploited flaw, CVE-2026-86950 (CoreGraphics). According to Apple, processing a maliciously crafted file may lead to arbitrary code execution; it is an out-of-bounds write, fixed with improved bounds checking. Apple fixed it on 28 September 2026 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The 26 October release extends this fix to devices still on iOS and iPadOS 18, with version 18.7.11.

The rest of the 26 October release. Apple’s advisories list a large number of fixed flaws. Among them:

• CVE-2026-86990 (CoreMedia): a malicious app may be able to access the camera without user permission, on iPhone, iPad and Mac.
• CVE-2026-112438 (macOS kernel): an unprivileged attacker may be able to execute arbitrary code as root.
• CVE-2026-112690: a remote attacker may be able to break out of the sandbox that isolates web content.
• Several WebKit flaws, the Safari engine, triggered by malicious web content.

Product	Affected versions	Fixed version
macOS Tahoe	before 26.7.1 for CVE-2026-86950, before 26.7.2 for the October release	26.7.2
macOS Sequoia	before 15.8.1 for CVE-2026-86950, before 15.8.2 for the October release	15.8.2
macOS Golden Gate	before 27.2 (CVE-2026-86950 not listed)	27.2
iOS and iPadOS 27	before 27.2 (CVE-2026-86950 not listed)	27.2
iOS and iPadOS 26	before 26.7.1 for CVE-2026-86950, before 26.7.2 for the October release	26.7.2
iOS and iPadOS 18 (iPhone XS, XS Max, XR, some iPads)	before 18.7.11	18.7.11
Safari	before 27.2	27.2

Sources: Apple security advisories of 28 September and 26 October 2026, NVD, maCERT bulletin 67052710/26.

Severity and exploitation

• Exploitation: Apple says it is aware of a report that CVE-2026-86950 may have been exploited in an extremely sophisticated attack against specific targeted individuals, on versions of iOS before iOS 27. The flaw is credited to Meta Product Security.
• CISA: the flaw has been in the KEV catalogue since 29 September 2026, as “Apple Multiple Products Out-of-Bounds Write Vulnerability”, with a remediation deadline of 13 October 2026 for US federal agencies.
• Published severity: the NVD shows a CVSS v3.1 score of 8.8 (high), supplied by CISA, with user interaction required.
• maCERT (DGSSI): bulletin 68912909/26 of 29 September describes the flaw as actively exploited, and bulletin 67052710/26 of 27 October rates the whole Apple release at a critical risk and impact level.

Interim measures

Apple’s advisories describe no workaround: only the update fixes the issue. If some devices cannot be updated straight away:

1. Remind users to be careful with files: the exploited flaw is triggered when a malicious file is processed. Unexpected attachments, files received over instant messaging or downloaded from an unknown link should be avoided until the update is installed. Our guide to the phishing scams targeting SMBs in Morocco lists the reflexes to share.
2. Prioritise exposed profiles: executives, finance, executive assistants and anyone handling sensitive data on an iPhone or Mac go first.
3. Restrict access: a device still running a vulnerable version should no longer reach company email or documents until it is updated.

Checks to carry out

• Inventory Apple devices: company Macs, iPhones and iPads, as well as personal devices that access business email.
• Check the installed version, not just the notification: an update that has been downloaded but not installed offers no protection. Check the version number shown on each device or reported in your management console.
• Spot stranded devices: an iPhone XS or XR should be on iOS 18.7.11; a device that no longer receives any security release should be replaced or removed from business access.
• Use your management console: an MDM for company smartphones shows the version of each device at a glance and, for supervised devices, can enforce the update. The same compliance logic applies to computers, as we describe for Microsoft Intune in SMBs.
• Do not forget Safari: Apple publishes Safari 27.2 in a separate advisory; check its version on every Mac after the system update.

Our view for businesses in Morocco

According to Apple, the exploited flaw targets specific individuals: this is not a mass campaign, but executives and sensitive roles are precisely who this kind of attack goes after. The most frequent risk we see is the executive’s phone that nobody manages and that has been postponing updates for weeks, and the creative team’s Mac that sits outside any inventory.

An alert like this points back to three basics: a complete inventory of devices with version tracking, managed EDR and 24/7 monitoring to spot abnormal behaviour, and a written update policy. For organisations in scope, law 05-20 and DGSSI requirements also require maCERT bulletins to be handled.

How we can help

We inventory your Macs, iPhones and iPads, deploy updates from a management console, check each device’s compliance and set up 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Apple security releases, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, iOS 26.7.1, iOS 18.7.11, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, iOS 27.2, iOS 26.7.2, CISA KEV catalogue, NVD CVE-2026-86950, maCERT bulletin of 27 October 2026, maCERT bulletin of 29 September 2026.