# Apple patches actively exploited CoreGraphics zero-day

Published: 2026-10-27 · Severity: severe
Canonical: https://vorant.io/reports/4ab910d2-e513-5d1b-9911-67c90b0641f6/apple-patches-actively-exploited-coregraphics-zero-day
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Apple fixed dozens of flaws across iOS, macOS, and WebKit, including CoreGraphics CVE-2026-86950, which is exploited in the wild and listed in CISA's KEV catalog.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121

## What to check

- Applies to: The 37 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-86950 as exploited in the wild.

MS-ISAC/CISA issued an advisory covering a large batch of Apple vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, patched in versions including iOS/iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, and macOS Sequoia 15.8.2. The most severe issues permit arbitrary code execution, in several cases with root, system, or kernel privileges, via maliciously crafted files, images, archives or web content processed by components such as CoreGraphics, WebKit, CoreMedia, ImageIO, Grapher, GPUTools, and the kernel. Additional flaws enable privilege escalation to root through Remote Management/Screen Sharing, CUPS, Security, StorageKit, configd, CVMS, Crash Reporter and CloudKit, as well as sandbox-escape and defense-evasion issues in App Store, WebKit Process Model, and dyld (pointer-authentication bypass).

Apple has confirmed that CVE-2026-86950 (a CoreGraphics arbitrary code execution flaw triggered by processing a maliciously crafted file) may have been exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on September 29, 2026. No other CVE in this batch is confirmed exploited. Given the breadth of affected platforms and active exploitation of at least one flaw, defenders should prioritize patching devices still on iOS/iPadOS 18 and systems used by high-risk individuals, apply least-privilege and anti-exploitation controls, and monitor for exploit attempts against Remote Management/Screen Sharing and web-content processing paths.

## Mentioned in this report

- Vulnerabilities: CVE-2026-112427, CVE-2026-112430, CVE-2026-112434, CVE-2026-112437, CVE-2026-112438, CVE-2026-112484, CVE-2026-112487, CVE-2026-112492, CVE-2026-112493, CVE-2026-112530, CVE-2026-112541, CVE-2026-112545, CVE-2026-112548, CVE-2026-112623, CVE-2026-112626, CVE-2026-112637, CVE-2026-112639, CVE-2026-112651, CVE-2026-112655, CVE-2026-112659, CVE-2026-112668, CVE-2026-112677, CVE-2026-112688, CVE-2026-112690, CVE-2026-112697, CVE-2026-113897, CVE-2026-113900, CVE-2026-113947, CVE-2026-64759, CVE-2026-65373, CVE-2026-84545, CVE-2026-86896, CVE-2026-86916, CVE-2026-86929, CVE-2026-86936, CVE-2026-86950 (KEV), CVE-2026-86958

## Detection guidance (public sample)

### macOS Safari or WebKit Content Process Spawning Shell or Download Utility

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs macos process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Safari or the WebKit WebContent/GPU/Networking helper spawning a shell, scripting interpreter or download tool, which is a post-exploitation pattern after a WebKit or CoreGraphics client-side exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Safari or WebKit Content Process Spawning Shell or Download Utility
description: Detects Safari or WebKit helper processes (WebContent, GPU, Networking)
  spawning a shell, scripting interpreter or download utility. Browser renderers do
  not normally launch these, so this is a strong sign of code execution after exploitation
  of a WebKit, CoreGraphics or ImageIO flaw from crafted web content.
tags:
- attack.execution
- attack.t1203
- attack.stealth
- attack.t1211
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
    - /com.apple.WebKit.WebContent
    - /com.apple.WebKit.GPU
    - /com.apple.WebKit.Networking
    - /Safari.app/Contents/MacOS/Safari
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
    - /osascript
    - /curl
    - /python3
    - /perl
    - /ruby
    - /nscurl
  condition: selection_parent and selection_child
falsepositives:
- Web developers running local tooling through Safari extensions or debugging helpers
- Security testing of browser exploit chains in lab environments
level: high
id: 3cf4f2ea-ae88-57f6-8e87-0341fa9fd806
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121
```

### macOS Image or Document Rendering Process Spawning Shell

ATT&CK: T1203

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs macos process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Preview, Quick Look or thumbnail-generation processes launching a shell, osascript or download tool, which is consistent with exploitation of a crafted image or file parsed by CoreGraphics or ImageIO. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: macOS Image or Document Rendering Process Spawning Shell
description: Detects Preview, Quick Look and thumbnail-agent processes spawning a
  shell, osascript or a download utility. These processes parse untrusted files through
  CoreGraphics and ImageIO, and a child interpreter suggests exploitation of a crafted
  file for code execution.
tags:
- attack.execution
- attack.t1203
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
    - /Preview.app/Contents/MacOS/Preview
    - /quicklookd
    - /QuickLookUIService
    - /com.apple.quicklook.ThumbnailsAgent
    - /QuickLookSatellite
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
    - /osascript
    - /curl
    - /python3
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- Third-party Quick Look plugins that shell out to helper scripts to render previews
level: medium
id: f0f54679-fc7d-5920-a0f4-16d91a0473b5
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-121

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4ab910d2-e513-5d1b-9911-67c90b0641f6/apple-patches-actively-exploited-coregraphics-zero-day.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup