CISA added one new vulnerability, CVE-2026-86950, an out-of-bounds write affecting multiple Apple products, to the Known Exploited Vulnerabilities (KEV) Catalog on September 29, 2026, citing evidence of active exploitation. Federal civilian agencies are required to act on KEV entries quickly under Binding Operational Directive 26-04, and CISA is encouraging every organization that runs Apple software to follow the same risk-based approach.<\/p>\n
The new entry is CVE-2026-86950, an out-of-bounds write vulnerability that affects multiple Apple products. An out-of-bounds write is a class of memory error where a program writes past the boundary of an allocated buffer, and that class of bug has long been a reliable foothold for attackers who want to take over a device or process.<\/p>\n
CISA flagged it as a frequent attack vector and a meaningful risk to the federal enterprise, which is what moves a vulnerability onto the catalog and turns it into something agencies have to fix on a deadline.<\/p>\n
Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, sets out vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive ties the KEV Catalog to remediation timing in two specific ways:<\/p>\n
BOD 26-04 applies only to FCEB agencies, but CISA’s standing guidance is that every organization should adopt risk-based vulnerability management and prioritize remediation of KEV Catalog entries.<\/p>\n
Patch the affected Apple products against CVE-2026-86950 as soon as the vendor-fixed build is available in your support channel, then verify the install on every publicly exposed device that matches the CVE’s scope. After patching, run compromise assessment steps on any internet-facing system where the vulnerable build was live before the update went on, because BOD 26-04 treats that kind of pre-patch review as the minimum bar for high-risk KEV items. Organizations outside the federal government that want to track which devices still need the update can pull the Apple advisory for CVE-2026-86950 and cross-check it against their asset inventory before the next exposure scan.<\/p>\n
CISA adds vulnerabilities to the KEV Catalog when they meet the catalog’s criteria, and the agency also accepts outside submissions through the KEV Nomination Form. For a candidate to be considered, three things are required:<\/p>\n
Submissions without all three are set aside. The form is the direct channel for security teams that have spotted a working exploit chain that is not yet listed.<\/p>\n
CISA added CVE-2026-86950, an out-of-bounds write vulnerability affecting multiple Apple products, based on evidence of active exploitation.<\/p>\n
Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets. CISA encourages all other organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities as well.<\/p>\n
Submissions are filed through CISA’s KEV Nomination Form and must include a CVE ID, evidence of exploitation, and clear mitigation guidance.<\/p>\n