Apple has fixed a security vulnerability affecting iPhones, iPads and Macs running its previous-generation operating systems. The company warned that the flaw may have been exploited in a sophisticated attack targeting specific individuals.

The vulnerability, tracked as CVE-2026-86950, affects iOS 26, iPadOS 26 and macOS 26. Apple said the flaw could have been used as part of an “extremely sophisticated attack” against targeted users running versions released before iOS 27.

Apple has released security updates for affected devices and urged users who have not upgraded to install the latest available software.

Vulnerability found in graphics engine

According to Apple’s security advisory, the flaw was found in a graphics component responsible for rendering interface elements and visual content on its devices.

Meta’s product security team was credited with discovering the vulnerability.

Apple has not released technical details about how the flaw could be exploited. It has also not disclosed how many users may have been affected by attacks involving the vulnerability.

The company has not identified who may have been behind any exploitation. Possible actors could include commercial spyware operators, government-linked groups or cybercriminals, but no such attribution has been publicly confirmed.

OpenAI Launches Dots for Always-On AI Tasks

Graphics components can interact with other parts of an operating system. As a result, successful exploitation of a vulnerability in such a component could potentially expose sensitive information or provide access to other system functions.

However, Apple has not publicly confirmed the level of access that could be gained through CVE-2026-86950.

Millions of devices could remain exposed

Although iOS 26 and the other affected operating systems have been replaced by newer versions, many devices may still be running them.

Apple’s developer statistics indicate that a large majority of iPhone users continue to use iOS 26. This means some devices could remain vulnerable until their software is updated.

Apple also released security updates for its latest operating systems, including iOS 27, iPadOS 27 and macOS 27. Those versions are not affected by CVE-2026-86950.

Apple recently fixed another serious flaw

The latest warning follows Apple’s recent fix for another vulnerability, CVE-2026-86869, which researchers described as a zero-click security flaw.

Belgian cybersecurity firm ironPeak said the vulnerability could be triggered through a specially crafted iMessage without requiring the victim to click a link or interact with the message.

According to the company, the flaw could bypass Apple’s BlastDoor security mechanism. BlastDoor is designed to isolate potentially malicious content delivered through iMessage.

Apple fixed the issue through updates for iOS 27, iPadOS 27 and macOS 27.

Apple credited ironPeak researcher Niels Hofmans and Meta security researchers with identifying the vulnerability.

It remains unclear whether CVE-2026-86869 was exploited in real-world attacks before Apple released the security updates.

What users should do

Users running iOS 26, iPadOS 26 or macOS 26 should check their devices for available software updates.

Installing the latest security release can help protect affected devices from known vulnerabilities.

Users should also keep automatic software updates enabled where available and install future security updates promptly.