Act archived

Apple Emergency Patch: CVE-2026-86950 Actively Exploited on iOS/macOS 26

2026-09-29 16:53 UTC · SANS ISC · read the source ↗ #apple #active-exploitation #cisa-kev

Engineer — Act: CVE-2026-86950 is CISA KEV-listed with active exploitation and a public PoC; update all iOS 26 and macOS 26/15 devices to Apple’s latest patched release immediately — iOS/macOS 27 branches are unaffected.
SOC/IR — Act: Active exploitation of a CISA KEV-listed Apple vulnerability means you should assume some corporate macOS/iOS devices may already be compromised; hunt for anomalous activity on unpatched macOS 15/26 and iOS 26 endpoints since at least the patch release date of 2026-09-28.
Leader — Act: Active exploitation of corporate Apple devices (macOS 15/26, iOS 26) with a CISA KEV listing warrants confirming this week that MDM-managed endpoints are receiving the emergency update and verifying coverage for any unmanaged devices.
Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources

This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.