Act
archived
Apple CoreGraphics CVE-2026-86950 PoC published, KEV-listed PDF flaw
- Engineer — Act: CISA KEV-listed and crash-level public PoC confirms exploitation is real; patch all macOS and iOS endpoints to Apple’s latest security release immediately, prioritizing internet-facing and executive devices.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation via crafted PDF; hunt for anomalous CoreGraphics crashes and WhatsApp-delivered PDF activity in EDR telemetry since the KEV add date, and tune detections for malicious font-embedded PDFs.
- Leader — Act: A CISA KEV-listed Apple vulnerability with a confirmed targeted-use pattern means executive iPhones and Macs are at risk; verify MDM fleet patch compliance and assess whether any high-value personnel may have been targeted before the patch was available.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.