# Apple patches actively exploited iOS zero-day

Published: 2026-10-27 · Severity: severe
Canonical: https://vorant.io/reports/bad51d0f-7d60-5852-8c65-95499e40fba6/apple-patches-actively-exploited-ios-zero-day
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns that CVE-2026-86950, exploited in the wild, is among 250+ flaws fixed in Apple's October 2026 security updates across iOS, macOS, Safari, tvOS, watchOS and visionOS.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1387

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-86950 as exploited in the wild.

CERT-FR has issued an advisory consolidating Apple's October 26, 2026 security bulletins, which address a very large batch of vulnerabilities across the full Apple software ecosystem: iOS/iPadOS (up to versions 18.7.11, 26.7.2 and 27.2), macOS Golden Gate, Sequoia and Tahoe, Safari, tvOS, visionOS and watchOS. The flaws span memory corruption, logic errors, and other weaknesses that can lead to arbitrary code execution, privilege escalation, data confidentiality breaches, denial of service, and security-policy bypass. Apple has confirmed that CVE-2026-86950 is being actively exploited in the wild, making it the priority patch target for affected organizations, particularly those managing fleets of Apple devices.

Given the breadth of products and CVE count (well over 250 identifiers referenced, including some older CVEs from 2019 and 2022 presumably addressed via updated components), defenders should treat this as a mass-patch event rather than a single-issue advisory. CERT-FR provides no technical details or exploitation specifics beyond confirming active exploitation of CVE-2026-86950; Apple's own bulletins (149225, 149227, 149230, 149521–149527) are the authoritative source for per-product fix details and CVE-to-impact mapping.

Recommended action is immediate deployment of the referenced updates to all iOS, iPadOS, macOS, Safari, tvOS, visionOS and watchOS devices below the fixed versions, with priority given to confirming remediation of CVE-2026-86950 given its confirmed in-the-wild exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2019-5598, CVE-2022-26704, CVE-2026-112410, CVE-2026-112413, CVE-2026-112414, CVE-2026-112415, CVE-2026-112416, CVE-2026-112417, CVE-2026-112421, CVE-2026-112423, CVE-2026-112424, CVE-2026-112425, CVE-2026-112427, CVE-2026-112428, CVE-2026-112429, CVE-2026-112430, CVE-2026-20648, CVE-2026-20649, CVE-2026-28864, CVE-2026-28991, CVE-2026-43736, CVE-2026-64750, CVE-2026-64759, CVE-2026-64767, CVE-2026-64789, CVE-2026-65327, CVE-2026-65339, CVE-2026-65350, CVE-2026-84493, CVE-2026-84494, CVE-2026-84495, CVE-2026-84496, CVE-2026-84498, CVE-2026-86880, CVE-2026-86896, CVE-2026-86916, CVE-2026-86920, CVE-2026-86950 (KEV), CVE-2026-86954, CVE-2026-86958

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1387

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bad51d0f-7d60-5852-8c65-95499e40fba6/apple-patches-actively-exploited-ios-zero-day.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup