The Center for Internet Security warns that Apple has fixed multiple vulnerabilities across iPhones, iPads, Macs, Apple Watches, Apple TVs and Apple Vision Pro, one of which attackers may already be exploiting.
Apple has released software updates addressing numerous security vulnerabilities across its full lineup of devices, according to the Center for Internet Security. The flaws affect iPhones and iPads running iOS and iPadOS, Mac computers, Apple Watch, Apple TV, Apple Vision Pro, and the Safari web browser.
The most serious of these vulnerabilities could allow arbitrary code execution, meaning an attacker could run malicious software on a device without the owner’s knowledge. In some cases, that malicious code could run with the highest level of system access, letting an attacker install programs, steal or alter data, or take broader control of the device.
One specific vulnerability, identified as CVE-2026-86950, may have already been used in attacks, according to Apple. The Cybersecurity and Infrastructure Security Agency added this flaw to its Known Exploited Vulnerabilities catalog on September 29, 2026, confirming it has been actively targeted.
The Center for Internet Security rates the risk as high for government agencies and businesses of all sizes, while rating the risk to home users as low. Vulnerable devices include those running iOS and iPadOS versions before 27.2, as well as older iOS and iPadOS 18 and 26 releases, several macOS versions, tvOS, watchOS, visionOS, and Safari.
For most readers, the takeaway is straightforward: check for and install the latest software update on your iPhone, iPad, Mac, Apple Watch, Apple TV, or Vision Pro as soon as it’s available. The Center for Internet Security specifically recommends prioritizing devices still running iOS or iPadOS 18, as well as devices belonging to people who may be at higher risk of being targeted. Installing updates promptly closes the door on vulnerabilities attackers could otherwise use to gain access to your device and personal information.
Based on a release from Center for Internet Security.
