Fixed for the phones that did not upgrade

Apple shipped seven software updates on Monday. Four of them, including iOS 27.0.1 and macOS Golden Gate 27.0.1, carry the line "This update has no published CVE entries." The other three fix one flaw, and it is one Apple says has been used.

The flaw is CVE-2026-86950, an out-of-bounds write in CoreGraphics, the framework that draws images and documents across Apple's systems. Apple's notes for iOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 describe the same impact: "Processing a maliciously crafted file may lead to arbitrary code execution." All three add the sentence Apple reserves for exploited bugs: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." The finder is credited as Meta Product Security.

The phrase to read is "before iOS 27". The fix was released for the older line, the one on devices whose owners have not taken the major upgrade Apple shipped on 14 September. This desk searched Apple's security notes for iOS 27 and macOS Golden Gate 27 for the CVE and did not find it, and the 27.0.1 updates list no CVEs at all. Apple has not said whether the current line was ever vulnerable. What its notes do say is where the attacks were seen, and that the repair went to the phones that stayed behind. The two macOS notes repeat the iOS sentence word for word, which says where the exploitation was reported rather than that Macs were attacked.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on Tuesday with a due date of 2 October: three days, the same window as every addition since 22 September, including the one it gave Citrix NetScaler on Sunday. The entry carries the forensic-triage flag, which under the implementation guidance for BOD 26-04 asks agencies to look for signs of compromise, not only to patch. Its "known ransomware campaign use" field reads "Unknown".

For an enterprise the practical instruction is narrower than the headline. The devices at risk, on Apple's account, are those still on iOS 26 or the two older macOS lines, and the fix for them is the .1 release of the version they are already on. A fleet that moved to 27 in the last fortnight is not named in any of Monday's notes. A fleet that held back, as many do in the first weeks of a major release, has three days on the federal clock and a targeted exploit already in use.