Apple fixes possibly exploited CoreGraphics flaw with iOS 26.7.1 and iPadOS 26.7.1
Apple has released iOS 26.7.1 and iPadOS 26.7.1 to fix a CoreGraphics vulnerability that it says may have been exploited in a sophisticated attack targeting specific individuals.
The updates, released on 28 September 2026, address CVE-2026-86950. Apple said the reported attack involved versions of iOS before iOS 27, but its advisory stops short of confirming a broad campaign or identifying who conducted it.
That distinction matters for understanding both the urgency and the limits of the disclosure. Apple has linked the vulnerability to a report of possible targeted exploitation, making the available fix important for eligible devices that remain on the version 26 branch. It has not said that every user faced the same likelihood of attack, or that every release before iOS 27 contained the flaw.
What CVE-2026-86950 can do
Apple describes CVE-2026-86950 as an out-of-bounds write in CoreGraphics. The company addressed the problem through improved bounds checking and credited Meta Product Security with reporting it.
According to the advisory, processing a maliciously crafted file may result in arbitrary code execution. That potential impact makes the flaw serious, but it does not by itself reveal how the attack worked or what happened after code execution became possible.
Apple has not disclosed the malicious file type, how a file reached a target or whether any user interaction was necessary. The advisory also provides no information about a wider exploit chain, such as the use of additional vulnerabilities.
The advisory therefore does not establish that this was a zero-click attack. Nor does arbitrary code execution prove that information was stolen from affected devices. No data theft, data loss or breach scope has been confirmed in the available disclosure, and Apple did not assign a CVSS score in the advisory.
Which devices can receive the fixed releases
For iPhone users remaining on the iOS 26 branch, the fixed iOS 26.7.1 release is available for iPhone 11 and later.
Apple lists iPadOS 26.7.1 for the iPad Pro 12.9-inch third generation and later, iPad Pro 11-inch first generation and later, iPad Air third generation and later, iPad eighth generation and later, and iPad mini fifth generation and later.
The guidance is branch-specific. Apple’s listed update is iOS 26.7.1 for eligible iPhones still running iOS 26, rather than a release that every iPhone necessarily needs. The advisory does not provide a complete matrix of unaffected versions.
Apple also has not provided a precise list of vulnerable builds below iOS 27. Its exploitation statement says the reported attack involved a pre-iOS 27 version, but that does not establish that every earlier version was vulnerable.
The company fixed the same CVE in iPadOS 26.7.1, although its advisory does not say that exploitation was observed on iPads. Eligible iPad users and administrators should still treat the fixed version as the relevant update for devices retained on the iPadOS 26 branch.
What remains unknown about the targeting
Apple has not disclosed the number, identities or locations of the targeted individuals. It has not identified an attacker, actor type, motive, spyware supplier or campaign duration. Descriptions of the perpetrators as cybercriminals, state-backed operators or any other particular group would therefore go beyond the available evidence.
The company’s wording is qualified: it is aware of a report of possible exploitation. That supports reporting selective targeting as a possibility, but not presenting a widespread attack as confirmed.
Those unknowns do not alter the availability of fixed versions for supported devices. Consumers can check whether an eligible device remains on version 26 and install the fixed release for that branch. Organisations managing compatible iPhones and iPads also have a deployment task where fleets remain on iOS or iPadOS 26.
June adoption figures do not show September usage
Available Apple usage statistics cannot establish how many devices still required the version 26 updates when they were released.
Apple’s published snapshot was measured on 7 June 2026. It recorded iOS 26 on 86 per cent of iPhones introduced during the previous four years and 79 per cent of all iPhones. For iPads, it recorded iPadOS 26 on 79 per cent of recent devices and 68 per cent of all devices.
Inc. used those figures in a 30 September article while discussing devices remaining on iOS 26 after iOS 27 became available. Because the measurements were taken in June, they cannot quantify late September usage or post-iOS 27 adoption.
The practical dividing line is therefore not an assumed percentage of users at risk. It is whether a supported device remains on the operating-system branch for which Apple issued iOS 26.7.1 or iPadOS 26.7.1.
That applies to Australian consumers and organisations using eligible models, although Apple has disclosed no Australia-specific victims or targeting. The fixed releases are clear; the scale, delivery route and perpetrators behind the reported attack are not.
Reading a disclosure carefully means separating a vulnerability's potential technical impact from evidence about delivery, targeting and data access. Continue building that technical foundation through The Hack Academy's online cybersecurity training programme, which offers self-paced study in cybersecurity fundamentals, with practical exercises alongside theory.
