HomeCIS AdvisoriesExample Page

Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2026-121

DATE(S) ISSUED:

10/27/2026

OVERVIEW:

Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution.

  • iOS is a mobile operating system for mobile devices, including the iPhone and iPod touch.
  • iPadOS is the operating system for iPad devices.
  • macOS is the operating system for Mac computers.
  • tvOS is the operating system for Apple TV devices.
  • watchOS is the operating system for Apple Watch devices.
  • visionOS is the operating system for Apple Vision Pro.
  • Safari is a web browser available for macOS, iOS, and iPadOS.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application or, in some cases, with root, system, or kernel privileges. Depending on the privileges associated with the application or service, an attacker could then install programs; view, change, or delete data; or take further control of the affected device.

THREAT INTELLIGENCE:

Apple has indicated that CVE-2026-86950 may have been exploited. On September 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) Catalog. 

SYSTEMS AFFECTED:

  • iOS and iPadOS versions prior to 27.2
  • iOS and iPadOS 26 versions prior to 26.7.2
  • iOS and iPadOS 18 versions prior to 18.7.11
  • macOS Golden Gate versions prior to 27.2
  • macOS Tahoe versions prior to 26.7.2
  • macOS Sequoia versions prior to 15.8.2
  • tvOS versions prior to 27.2
  • watchOS versions prior to 27.2
  • visionOS versions prior to 27.2
  • Safari versions prior to 27.2 (on macOS Sequoia and macOS Tahoe)

RISK:

Government:
Large and medium government entitiesHIGH
Small governmentHIGH
Businesses:
Large and medium business entitiesHIGH
Small business entitiesHIGH
Home Users:
LOW

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Details of the most severe of these vulnerabilities are as follows. For a full list of vulnerabilities, please visit the Apple advisories listed in the reference section. 

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application or with elevated privileges. Depending on the privileges associated with the application or service, an attacker could then install programs; view, change, or delete data; or take further control of the affected device. Failed exploitation could result in a denial-of-service condition.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate updates provided by Apple to vulnerable systems immediately after appropriate testing, prioritizing devices still running iOS or iPadOS 18 and other devices used by high-risk individuals. (M1051: Update Software)
  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
  • Safeguard 7.2: Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
  • Safeguard 7.3: Perform Automated Operating System Patch Management: Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
  • Apply the principle of least privilege to all systems and services, and run all software as a non-privileged user (one without administrative rights) to diminish the effects of a successful attack. (M1026: Privileged Account Management)
  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.
  • Remind users not to visit websites or follow links provided by unknown or untrusted sources, and not to open files or attachments from unknown or untrusted senders. (M1017: User Training)
  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner.
  • Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
  • Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
  • Restrict use of certain websites, block downloads or attachments, and block JavaScript from untrusted sources where feasible. (M1021: Restrict Web-Based Content)
  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites.
  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise's email gateway.
  • Prevent installation and execution of unauthorized applications, including through mobile device management (MDM) controls on managed Apple devices. (M1038: Execution Prevention)
  • Safeguard 2.5: Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
  • Use network intrusion detection and prevention systems to detect and block malicious network traffic, including activity targeting Remote Management and Screen Sharing services. (M1031: Network Intrusion Prevention)
  • Safeguard 13.3: Deploy a Network Intrusion Detection Solution: Deploy a network intrusion detection solution on enterprise assets, where appropriate.
  • Safeguard 13.8: Deploy a Network Intrusion Prevention Solution: Deploy a network intrusion prevention solution, where appropriate.


REFERENCES:

Apple
CVE

Get Email Updates When Cyber Threats Like This Arise

Subscribe to Advisories

Information Hub

Advisories

See All Advisories
Press Release10.27.2026
CIS, MS-ISAC, and CoSN Report: K-12 Schools Face Growing Cyber Threats Amid Resource Constraints and Rapid AI Adoption
Read More Press Release
Advisory10.27.2026
Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
Read More Advisory
Advisory10.27.2026
A Vulnerability in Brotli Library Could Allow for Remote Code Execution
Read More Advisory
White Paper10.27.2026
The State of K-12 Cybersecurity 2026
Read More White Paper