CVE-2026-86950
Known exploited · CISA KEV
CVSS 8.8 HIGH: an out-of-bounds write issue was addressed with improved bounds checking.
CISA federal remediation date Oct 2 · date passed
Vulnerabilities & Exploits
Apple's October 2026 updates fix 304 vulnerabilities, including an iOS 18 patch for an already-exploited CoreGraphics flaw, SANS Internet Storm Center reports. The flaw, CVE-2026-86950, had been patched about a month earlier; this release brings the corresponding fix to iOS 18.
SANS says the October release did not mark any new vulnerability as exploited. Its report gives no exploit mechanics for CVE-2026-86950; the development is the platform-specific fix, not a newly reported attack method.
For organizations managing iOS 18 alongside macOS, iPadOS, or watchOS, an earlier Apple update was not proof of complete remediation: iOS 18 devices remained exposed until their matching patch arrived. Coverage for one flaw can therefore differ across platforms even when teams consider the vendor update cycle complete.
1 source · Oct 27
Known exploited · CISA KEV
CVSS 8.8 HIGH: an out-of-bounds write issue was addressed with improved bounds checking.
CISA federal remediation date Oct 2 · date passed
SANS ISC
Apple Patches for October 2026 - SANS Internet Storm Center
Apple Patches for October 2026, Author: Johannes Ullrich
originalPart of the PlainSec briefing for 2026-10-26
Every edition of this story: Apple's October update closes exploited CoreGraphics flaw on iOS 18