An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

A zero-day in Apple's CoreGraphics component has reportedly been exploited in 'an extremely sophisticated attack.' We are monitoring for further intel.

The version of Apple iOS running on the mobile device is prior to 26.7.1. It is, therefore, affected by a vulnerability.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.1. It is, therefore, affected by a vulnerability:

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS     26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file     may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited     in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS     27. (CVE-2026-86950)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.8.1. It is, therefore, affected by a vulnerability:

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS     26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file     may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited     in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS     27. (CVE-2026-86950)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Type	Severity
350922	Apple iOS < 26.7.1 Vulnerability (149226)	Nessus	Mobile Devices	Local	high
350912	macOS 26.x < 26.7.1 (149228)	Nessus	MacOS X Local Security Checks	Local	high
350911	macOS 15.x < 15.8.1 (149229)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-86950

high

Tenable Plugins

high

high

high