1.0 Introduction
Recently, Apple released security updates to address a high-severity vulnerability (CVE-2026-86950) in Apple Products.
2.0 Impact
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on a vulnerable device when it processes a maliciously crafted file. This may lead to unauthorised access to sensitive information, installation of malware or spyware, and full device compromise. Apple's advisory suggests that attacks have so far been observed only against iOS, and only against specific targeted individuals. All unpatched devices remain exposed if exploitation spreads.
3.0 Affected Products
- iOS versions prior to 26.7.1
- iPadOS versions prior to 26.7.1
- macOS Tahoe versions prior to 26.7.1
- macOS Sequoia versions prior to 15.8.1
Users and administrators should refer to the respective Apple security advisories for the full list of affected devices and versions.
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to update to the latest software as soon as possible: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, or upgrade to version 27 where the device supports it.
Kindly refer to the following URL:
- https://support.apple.com/en-hk/149226
- https://support.apple.com/en-hk/149228
- https://support.apple.com/en-hk/149229
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://support.apple.com/en-hk/149226
- https://support.apple.com/en-hk/149228
- https://support.apple.com/en-hk/149229
- https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog