Apple releases patches for graphics engine flaw affecting iOS 26, iPadOS 26 and macOS 26
Apple has issued an update that closes a vulnerability in its 26-series operating systems, which could have been exploited to access personal data on iPhones, iPads and Macs.
Apple announced that a security flaw in the graphics engine of iOS 26, iPadOS 26 and macOS 26 has been patched. The vulnerability, identified as CVE-2026-86950, was said to allow a sophisticated attack that could target specific individuals and potentially expose a wide range of personal information.
The issue was discovered by Meta’s product security team, according to Apple’s security advisory. While details of the exploit were not disclosed, the graphics engine typically has extensive system privileges, making the bug a serious concern.
Apple reported that roughly 80% of iPhone users are still on iOS 26, meaning many devices remain vulnerable until they install the new update. Devices already running iOS 27, iPadOS 27 or macOS 27 received a separate update and are not affected by this particular flaw.
The patch follows a recent fix for another critical vulnerability, CVE-2026-86869, described by Belgian firm ironPeak as a zero-click bug that could be triggered through a crafted iMessage and bypass Apple’s BlastDoor protection. That bug was also patched with the release of the iOS 27 suite.
Apple and Meta declined to comment on how the flaw was discovered or whether it had been actively exploited.