Apple products: remote code execution vulnerability | 09/29
The HKCERT advisory confirms that CVE-2026-86950 has been exploited in the wild. Check the impact against your product and deployment conditions.
Basis: the official source labels this high risk. GDMME follow-up priority uses official ratings and headline/summary rules. It is not a CVSS score or official vulnerability rating, and does not confirm that your business is affected.
Source severity
高度風險（HKCERT）
Affected scope
Scope listed in the advisory: versions earlier than iOS 26.7.1 and iPadOS 26.7.1; versions earlier than macOS Tahoe 26.7.1; versions earlier than macOS Sequoia 15.8.1. The advisory describes attacks targeting specific users.
Official recommendations
Automatically extracted recommendation passages from the official source, retained in the source language. Check the complete advisory.
- 在安裝軟體之前 請先瀏覽供應商之網站 以獲得更多詳細資料
- 安裝供應商提供的修補程式：
- iOS 26.7.1 及 iPadOS 26.7.1 版本
- macOS Tahoe 26.7.1 版本
- macOS Sequoia 15.8.1 版本
The last successful extraction is used here. Check the official source for the latest content.
Source text collected (Hong Kong time)：2026/10/12 02:44 HKT
官方原文建議自動摘錄 未作逐篇人工分析或翻譯；請核對完整公告、現行版本及適用性
GDMME recommended actions
GDMME recommendations · automatically organised from explicit products and source signals, without individual human analysis. Confirm applicability against vendor guidance and your environment.
- Locate Apple iOS / iPadOS / Apple macOS deployments, running versions and service owners in your inventory or management console; compare them with the vendor applicability criteria. A named product does not mean every deployment is affected.
- Use MDM or your device inventory to check Apple iOS / iPadOS / Apple macOS updates and device support. Apply updates and restarts required by the vendor; separately assess work-data access on devices that cannot update.
- Check installed mobile apps, work-data permissions and sign-in sessions against company policy. Stop sensitive activity on a suspicious device and have the responsible team verify it.
Automatically organised (Hong Kong time)：2026/10/12 23:05 HKT
Educational information only. Confirm affected versions, mitigations and exploitation status with the original vendor advisory. Reports do not imply that GDMME equipment blocks every vulnerability.