Apple fixes security flaw affecting iOS 26, iPadOS 26 and macOS 26

Apple has fixed a security vulnerability in iOS 26, iPadOS 26 and macOS 26 that the company says “may have been exploited” in attacks against specific targeted individuals.

The flaw, classified as CVE-2026-86950, was found in the graphics engine that powers the interface and visuals on iPhones, iPads and Macs. Meta’s product security team was credited with discovering it. Apple has not released technical details or said how many people, if any, were affected. The company and Meta did not comment to TechCrunch on how the vulnerability was discovered. It is also unclear who may have exploited it.

A successful exploit could potentially let an attacker access personal data on an affected device, though the source does not confirm that this happened. Apple’s statistics show almost four-in-five iPhone owners are still using iOS 26.

Apple also released an update on Tuesday for iOS 27, iPadOS 27 and macOS 27, which came out earlier this month. Those versions are not affected by CVE-2026-86950.

The patch follows Apple’s fix for a separate vulnerability, CVE-2026-86869, which ironPeak described last week as a “zero-click” flaw that could be triggered through a malicious iMessage. Apple fixed that issue in September with the release of iOS 27, iPadOS 27 and macOS 27. The source says it is not known whether the flaw was used in attacks before the fix.