CISA adds Apple out-of-bounds write CVE-2026-86950 to KEV
CISA has added an Apple out-of-bounds write flaw, CVE-2026-86950, to its Known Exploited Vulnerabilities catalog on evidence of active exploitation. The alert covers multiple Apple products, so mobile and endpoint teams should check their own exposure now.
Key Takeaways
- CISA added CVE-2026-86950, an Apple out-of-bounds write, to the KEV catalog based on evidence of active exploitation.
- The CISA entry lists the affected vendor and product as 'Apple Multiple Products', so more than one Apple platform may be in scope.
- KEV inclusion means exploitation has been observed, not merely that exploitation is possible. Patch prioritisation should change accordingly.
- The CISA alert does not give a due date. Teams should confirm affected versions and fixes in Apple's own advisory.
What CISA has announced
In its alert of 29 September 2026, CISA says it has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The entry is CVE-2026-86950, an out-of-bounds write in what CISA lists as "Apple Multiple Products".
The alert is short. It does not name affected OS versions, describe the exploitation, or say who is exploiting the flaw. We therefore make no claims about those points here. Treat Apple's own security advisory as the authority for affected builds and fixed releases.
Why an out-of-bounds write matters
An out-of-bounds write is a memory-safety flaw. Code writes data outside the buffer it was meant to use. Depending on what sits next to that buffer, the result can range from a crash to corrupted state that an attacker can steer. This class of bug is a common building block in exploit chains.
We cannot say from the CISA alert how CVE-2026-86950 is reachable or what an attacker needs to trigger it. That is why the KEV listing carries the weight here. Whatever the mechanism, someone has used it in the wild.
What KEV inclusion changes
Most vulnerability backlogs are ranked by severity score. KEV is a different signal: it records vulnerabilities with evidence of real-world exploitation. A listed flaw should move ahead of unexploited items with higher scores. The CISA alert also references Binding Operational Directive 26-04, which sets remediation expectations for US federal agencies. It does not give a due date for this entry.
What mobile and endpoint teams should do
- 1Inventory Apple devices. Include managed and unmanaged iPhones, iPads and Macs, plus any other Apple products your estate runs. The CISA entry says 'multiple products', so do not assume one platform.
- 2Read Apple's advisory for CVE-2026-86950 and map the fixed releases to your fleet.
- 3Push updates through MDM and track compliance. Set a short deadline for devices that fall behind, and raise the priority of devices used by high-risk staff.
- 4Check where updates are deferred. Update deferral policies and BYOD exceptions are where a KEV-listed flaw tends to persist.
- 5Add the CVE to detection and triage workflows, so that an unusual crash or compromise report on an Apple device is assessed with this CVE in mind.
Limits of what is known
The alert says exploitation is active but gives no victim profile, campaign attribution or scale. Do not read targeted or widespread exploitation into it. Plan for the possibility that the flaw is exploited against your users, and patch on that basis.
Frequently Asked Questions
What is CVE-2026-86950?
It is an out-of-bounds write vulnerability in what CISA lists as 'Apple Multiple Products'. CISA added it to the KEV catalog based on evidence of active exploitation.
What does KEV inclusion mean for patching?
It means exploitation has been observed in the wild. Prioritise it above vulnerabilities that are only theoretically exploitable, even if those carry higher scores.
Where do I find the affected versions and fixes?
The CISA alert does not list them. Check Apple's security advisory for CVE-2026-86950 and match its fixed releases against your device inventory.