Apple Patches Actively Exploited iPhone Flaw in iOS 26.7.1

September 29, 2026

Apple has shipped an urgent security update for iPhone owners still running iOS 26, fixing a vulnerability the company says may already have been used against a small number of people.

A smartphone installing an operating-system security update — iOS 26.7.1 is a focused security update for users who have not moved to iOS 27.

Released September 28 alongside iPadOS 26.7.1 and updates for older Mac software, iOS 26.7.1 is narrow in scope. Apple's security information lists one fix, in CoreGraphics, but the small release carries unusual urgency because the flaw may have been exploited before a patch was available.

What the Flaw Does

The vulnerability is tracked as CVE-2026-86950 and sits in CoreGraphics, Apple's framework for rendering images and other visual content. Processing a maliciously crafted file could lead to arbitrary code execution, allowing an attacker to run code of their choosing on the device.

Apple describes the underlying problem as an out-of-bounds write. That memory-safety error occurs when software writes data beyond the space assigned to it. Improved bounds checking closes the gap. Meta Product Security received credit for reporting it.

Smartphone image breaking into digital memory blocks — The CoreGraphics flaw could be triggered when a device processed a maliciously crafted file.

Exploited in Targeted Attacks

Apple says it is aware of a report that the issue may have been exploited in an “extremely sophisticated attack” against specific targeted individuals on versions of iOS before iOS 27.

The company has not said who was targeted or identified the attack tool. Its wording does not mean every iPhone running iOS 26 was attacked, but it does make prompt installation more important for anyone remaining on the older software branch.

A single smartphone illuminated as network traces converge on it — Apple says the exploit was associated with an extremely sophisticated attack against specific people.

Who Needs the Update

The patch is intended for people who have stayed on iOS 26 instead of upgrading to iOS 27. It is available for iPhone 11 and later. People already running iOS 27 do not need this particular point update.

iPadOS 26.7.1 covers the 12.9-inch iPad Pro from the third generation onward, every 11-inch iPad Pro, iPad Air from the third generation onward, iPad from the eighth generation onward, and iPad mini from the fifth generation onward.

Smartphone, tablet, and laptop receiving coordinated security updates — Related fixes also arrived for supported iPads and Macs on the older software branches.

Macs Are Affected Too

The same CoreGraphics fix is included in iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Mac users on either supported branch should check Software Update in System Settings.

The release arrived in a wider batch that also included iOS 27.0.1 and iPadOS 27.0.1. Those are maintenance updates for the newest operating-system generation, while 26.7.1 keeps the previous branch protected for users who are not ready or able to move.

A person installing a security update on a smartphone connected to power — Back up important data, then install the update from Settings while the phone has sufficient power.

How to Update

On an iPhone remaining on iOS 26, open Settings, choose General, then select Software Update. Back up important data first and connect the phone to power if its battery is low.

For anyone staying on the older software, iOS 26.7.1 is now the minimum version to look for. Because Apple believes the flaw has already been exploited, this is an update to install now rather than postpone.