Apple Patches CoreGraphics Zero-Day CVE-2026-86950 in iOS/macOS

Tue, 29 Sep 2026 16:53:02 +0000

Engineer — Act: CISA KEV listed and public PoC available confirm active exploitation risk; update all managed iOS, iPadOS, and macOS devices to Apple’s patched releases immediately, prioritizing internet-facing or executive-owned endpoints.
SOC/IR — Plan: No IOCs or TTPs have been published yet, so no immediate hunt is possible; monitor threat intel feeds for emerging indicators and prepare to sweep EDR telemetry for anomalous file-processing activity on Apple endpoints once details surface.
Leader — Plan: KEV-listed Apple zero-day exploited in targeted attacks elevates risk for executive devices; confirm MDM policy enforces this patch across all managed Apple assets and flag to leadership that privileged users may be higher-value targets.
Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources

Apple-Zero-Day on CuraSec