Swiss SME Cyber Alert: Apple devices – actively exploited flaw requires prompt updates
On 28 September 2026, Apple released security updates for a vulnerability that had already been used in targeted attacks. The affected products include iPhones, iPads and Macs. If your business uses Apple devices, ask your IT provider to confirm that the fixed versions are installed across the fleet.
What happened?
CVE-2026-86950 affects CoreGraphics, an Apple component that processes images and other graphical files. A specially crafted file can trigger a memory error during processing and may allow an attacker’s code to run.
Apple says the flaw may have been used in an extremely sophisticated attack against specific individuals running older iOS versions. CISA added it to the Known Exploited Vulnerabilities catalog on 29 September 2026.
Could my business be affected?
Yes, if employees use iPhones, iPads or Macs that have not received the security updates released on 28 September 2026. Devices used by executives, administrators and staff who regularly open files from external sources deserve particular attention.
The published remediation information identifies iOS and iPadOS 27.0.1 or 26.7.1, macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 as the fixed versions.
What should you do now?
Ask your IT provider to review the Apple fleet and the mobile-device management platform. They should confirm that fixed operating-system versions are installed, including on infrequently used or unmanaged devices.
Prioritise devices used by people who may be more exposed to targeted attacks. Where updates are centrally deployed, verify that no endpoints are still waiting for, or have failed, the rollout.
How urgent is it?
Priority is high because real-world exploitation is confirmed and a malicious file may lead to code execution. The publicly described attacks were highly targeted and sophisticated, and there is currently no evidence of broad mass exploitation. This is not a reason for alarm, but it does justify a prompt version check.
Information for your IT provider
CVE-2026-86950 is an out-of-bounds write in CoreGraphics with a CVSS score of 8.8. Exploitation requires the processing of a specially crafted file and may result in arbitrary code execution in the context of the affected process.
At minimum, review iOS/iPadOS versions below 27.0.1 or 26.7.1, macOS Golden Gate below 27.0.1, Tahoe below 26.7.1 and Sequoia below 15.8.1. Include MDM exceptions, failed installations and devices that have been offline for an extended period.
