CISA flags an actively exploited Apple out-of-bounds write flaw

CISA has added CVE-2026-86950 to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The agency labels it an out-of-bounds write vulnerability affecting Apple Multiple Products. That flaw class involves software writing beyond its intended memory area, but CISA’s alert does not describe the exploit chain.

The catalog entry confirms exploitation in the wild, not the scale of a campaign. The alert does not identify individual Apple products or versions, name victims, count attacks, or provide a product-specific patch in the notice. CISA nevertheless describes this vulnerability class as a frequent attack route for malicious actors and a significant risk to the federal enterprise.

What the federal directive requires

Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. It requires rapid remediation when a KEV-listed vulnerability affects a publicly exposed asset and successful exploitation grants total control of that asset, while allowing lower-risk vulnerabilities to be deferred. The directive also establishes expectations for checking whether attackers compromised a system before a patch was installed.

Organizations outside those federal agencies are not bound by the directive. CISA encourages all organizations to use risk-based vulnerability management and prioritize remediation of vulnerabilities in the KEV Catalog.