Apple Patches Critical Exploitable Flaw in iOS 26, iPadOS 26, and macOS 26

Apple has released a security patch addressing a critical vulnerability in iOS 26, iPadOS 26, and macOS 26, following warnings that the flaw could have been actively exploited by attackers. The company cautioned that the bug allowed for highly sophisticated targeting of individuals using versions of iOS prior to the latest iOS 27 release.

According to details published on Apple’s security page, the vulnerability resides in the core graphics engine responsible for rendering visuals and interfaces across iPhones, iPads, and Macs. Meta’s product security team is credited with identifying the issue, which is officially designated as CVE-2026-86950.

While Apple has not disclosed specific technical details regarding the exploit, security experts note that the graphics engine typically holds broad access to the rest of the operating system. A successful attack could potentially grant hackers extensive access to personal data stored on affected devices.

Representatives for both Apple and Meta declined to comment on the discovery process or confirm whether any incidents of exploitation have occurred. It also remains unclear whether the vulnerability was leveraged by nation-state actors, commercial spyware vendors, or other cybercriminals.

The fix is particularly urgent given the widespread adoption of the older software. Apple’s own statistics indicate that nearly 80% of iPhone users are still operating on iOS 26. Devices running the current generation of software—iOS 27, iPadOS 27, and macOS 26, all released earlier this month—are not affected by this specific flaw, though they did receive a separate patch on Tuesday.

This announcement follows closely on the heels of another significant security resolution. Apple recently patched a distinct zero-click vulnerability, CVE-2026-86869, which Belgian cybersecurity firm ironPeak revealed could allow hackers to silently exfiltrate data via malicious iMessages.

The zero-click flaw was notable for its ability to bypass BlastDoor, a sandboxing security feature designed to prevent malicious code from escaping iMessage and compromising the device. Apple fixed that issue in September alongside the launch of iOS 27 and credited ironPeak researcher Niels Hofmans and Meta’s security team with the discovery. It is currently unknown if the zero-click bug was utilized in attacks prior to its remediation.