Apple iOS, iPadOS, macOS and visionOS September 2026 security updates: exploited file-processing flaw fixed

The release at a glance

Apple's September 2026 security updates address two CVEs across iOS and iPadOS, macOS and visionOS. One CVE, CVE-2026-86950, is a high-severity out-of-bounds write (CVSS 3.1 score 8.8) fixed with improved bounds checking. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on 29 September 2026, with a due date of 13 October 2026; ENISA EUVD records exploitation since 29 September 2026. The second, CVE-2026-86990, is unscored and addresses an access issue that could allow a malicious app to access the camera without user permission. Both CVEs have fixes available.

What matters most

Two CVEs need attention this month.

CVE-2026-86950 – iOS, iPadOS and macOS. This is the priority. An out-of-bounds write (CWE-787) fixed by improved bounds checking can lead to arbitrary code execution when a user processes a maliciously crafted file. Apple's CVSS 3.1 score is 8.8 high, and the vendor states it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CISA KEV, CISA SSVC and ENISA EUVD all record active exploitation. Fixed versions are iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. This CVE has a separate advisory page on this site.

CVE-2026-86990 – iOS, iPadOS, macOS and visionOS. An access issue was addressed with improved access restrictions. A malicious app may be able to access the camera without user permission. Apple has not assigned a CVSS score. It is not listed in CISA KEV and there is no statement of exploitation. Fixed versions are iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2 and visionOS 27.2.

Patch in this order

1. Patch CVE-2026-86950 first. This is the exploited out-of-bounds write. CISA's due date is 13 October 2026. Apply the fixes for iOS and iPadOS 18.7.11 or 26.7.1, and macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1. Apple says the attack it is aware of targeted specific individuals on versions of iOS before iOS 27, so prioritise iOS and iPadOS fleets.

1. Then address CVE-2026-86990. This is not exploited and not in CISA KEV, but it allows a malicious app to access the camera without permission. Update iOS and iPadOS to 18.7.11, 26.7.2 or 27.2; macOS to Tahoe 26.7.2 or Golden Gate 27.2; and visionOS to 27.2.

Beyond the patch

When a vendor confirms exploitation of a file-processing flaw, the immediate priority is visibility: can you detect the same activity in your estate? Spirity's Managed Detection & Response (MDR) provides monitoring and response for this kind of exploited vulnerability, while the Incident Response Retainer gives you a prepared path to contain and investigate if something is found. A single exploited CVE is manageable with a focused patch cycle and the right detection behind it.