Apple has released the iOS 26.7.1 security update and iPadOS 26.7.1 to address a CoreGraphics vulnerability that may have been used in a highly targeted attack. If your iPhone or iPad is still on the iOS 26 generation, this is an update to install promptly rather than leave for later.
The update arrived on 28 September 2026 alongside iOS 27.0.1 and several Mac, Apple Watch and Vision Pro updates. Apple says the flaw affected versions of iOS before iOS 27, so devices already running iOS 27 are not identified as vulnerable to this particular issue.
What the iOS 26.7.1 security update fixes
Apple’s official security advisory lists one fix in iOS 26.7.1 and iPadOS 26.7.1. The vulnerability, tracked as CVE-2026-86950, affects CoreGraphics—the system framework used to draw and process visual content.
According to Apple, processing a maliciously crafted file could cause arbitrary code execution. In practical terms, a specially prepared file might exploit the flaw and make a device run code chosen by an attacker. Apple fixed the out-of-bounds write issue with improved bounds checking and credited Meta Product Security for reporting it.
Apple also says it is aware of a report that the vulnerability may have been exploited in an “extremely sophisticated attack” against specific targeted individuals. That wording suggests a focused campaign rather than widespread exploitation. However, now that the weakness is publicly documented, delaying the patch creates unnecessary risk.
Which iPhones and iPads are affected?
Apple lists iOS 26.7.1 for iPhone 11 and later. The iPadOS update is available for:
- iPad Pro 12.9-inch (3rd generation and later)
- iPad Pro 11-inch (1st generation and later)
- iPad Air (3rd generation and later)
- iPad (8th generation and later)
- iPad mini (5th generation and later)
Some of these devices can also move to iOS 27 or iPadOS 27, while certain older iPads remain on the iPadOS 26 security branch. Check Settings > General > Software Update to see the version Apple recommends for your specific hardware.
What about iOS 27.0.1?
Apple released iOS 27.0.1 and iPadOS 27.0.1 on the same day. Its security releases page says those updates have no published CVE entries. Apple’s CVE-2026-86950 advisory specifically refers to exploitation on versions before iOS 27, indicating that iOS 27 already contains protection against this flaw.
If you have already upgraded, install iOS 27.0.1 when it appears because point releases commonly improve reliability after a major launch. For a broader overview of the new system, see our iOS 27 release guide.
Should you install iOS 26.7.1 now?
Yes. Anyone remaining on iOS 26 or iPadOS 26 should install version 26.7.1 as soon as practical. The patch closes a documented code-execution vulnerability, and Apple has acknowledged a report of real-world exploitation. You do not need to be a likely target to benefit from closing the security gap.
Before updating, make a current iCloud or computer backup, connect to reliable Wi-Fi and ensure the battery has enough charge. Apple’s update instructions recommend backing up first, then opening Settings, selecting General and tapping Software Update.
How to install the update
- Back up your iPhone or iPad using iCloud, Finder or Apple Devices on Windows.
- Connect the device to Wi-Fi and, ideally, power.
- Open Settings > General > Software Update.
- Select the offered iOS 26.7.1, iPadOS 26.7.1 or iOS/iPadOS 27 update.
- Tap Download and Install and follow the prompts.
If the update does not appear, restart the device, disable any VPN temporarily and check again. Managed work devices may follow an organisation’s update schedule. Our new iPhone setup guide also covers backups and other useful security checks.
Why this vulnerability matters
CoreGraphics handles content that users encounter throughout iOS, so a file-processing flaw deserves attention even when attacks are described as highly targeted. The advisory does not say that every malicious file will compromise a device, and it does not identify the targets or attack method. Users should avoid speculation and rely on Apple’s confirmed details: the bug enabled arbitrary code execution, older software was affected, and patched releases are available.
Keeping automatic updates enabled helps with future fixes. Go to Settings > General > Software Update > Automatic Updates and enable automatic installation if that suits your needs.
Final thoughts
The iOS 26.7.1 security update is small but important. Users staying on iOS 26 should install it promptly, while iOS 27 users should take the separate 27.0.1 maintenance release offered to their device. Back up first, update from Settings, and avoid downloading supposed update files from links or messages.
FAQs
What is CVE-2026-86950?
It is an out-of-bounds write vulnerability in CoreGraphics. Apple says a maliciously crafted file could lead to arbitrary code execution.
Was the iPhone flaw actively exploited?
Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27.
Do iOS 27 users need iOS 26.7.1?
No. Devices on iOS 27 follow the iOS 27 update branch. Install iOS 27.0.1 if it is offered instead.
Should I back up before updating?
Yes. A recent iCloud or computer backup is a sensible precaution before any operating-system update.
Is iPadOS 26.7.1 included?
Yes. Apple released iPadOS 26.7.1 with the same CoreGraphics security fix for compatible iPads.
Leave a Reply