Apple Backports Exploited CoreGraphics Fix to iPhone XS, XR and iPad 7th Gen. Update to iOS 18.7.11

TL;DR: On Oct 26, Apple released iOS and iPadOS 18.7.11 for older devices, back to the iPhone XS and XR. It fixes CVE-2026-86950, a CoreGraphics bug that Apple says “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” This isn’t a new zero-day: Apple fixed the same flaw for iOS 26 and Macs on Sep 28, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on Sep 29. What’s new is the fix for phones and tablets that can’t run iOS 26. If your office still has an iPhone XS, XS Max, XR or a 7th-generation iPad, update it to 18.7.11 today. Devices on iOS or iPadOS 26 need 26.7.1 or later. Apple shipped a large batch the same day, including iOS 27.2, and none of those notes says a flaw was exploited.

What happened

Apple’s security notes for iOS 18.7.11 and iPadOS 18.7.11, dated October 26, 2026, list three fixes:

• CoreGraphics, CVE-2026-86950. “Processing a maliciously crafted file may lead to arbitrary code execution.” Apple calls it an out-of-bounds write, credits Meta Product Security, and says it is aware of a report that it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
• Audio, CVE-2026-65339. “An app may be able to leak sensitive user information.”
• CoreMedia, CVE-2026-86990. “A malicious app may be able to access the camera without user permission.”

Apple marks only the CoreGraphics flaw as possibly exploited, and gives no further detail on the attacks. The previous update for these devices, iOS 18.7.10 on August 17, doesn’t list CVE-2026-86950.

The CoreGraphics fix first shipped on September 28 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. CISA added CVE-2026-86950 to the KEV catalog on September 29 (CISA alert) and gave US federal civilian executive branch (FCEB) agencies until October 13 to fix or mitigate it under Binding Operational Directive 26-04. That deadline binds only those agencies, and it passed before the older-device fix existed. The KEV entry, listed as Apple “Multiple Products,” gives known use in ransomware campaigns as “Unknown” and doesn’t yet link the 18.7.11 notes. The CVE record, updated by Apple on October 26 (US time), now lists 18.7.11 as a fix alongside 26.7.1, 15.8.1 and Tahoe 26.7.1; its affected ranges for iOS and iPadOS end below 18.7.11 and 26.7.1, so iOS 27 isn’t listed, and Apple’s iOS 27.2 notes don’t mention CVE-2026-86950. CISA’s added data in the record scores it 8.8 (High) on CVSS 3.1; that score is CISA’s, not Apple’s.

On the same day, Apple released iOS and iPadOS 27.2 (more than 150 CVE entries), iOS and iPadOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, plus tvOS, watchOS and visionOS 27.2. As of our check, none of those notes says a flaw may have been exploited, and none lists CVE-2026-86950.

Why it matters

Attacks Apple calls “extremely sophisticated” and aimed at “specific targeted individuals” usually aren’t aimed at the average small office. But the flaw is in KEV, and older devices that can’t run iOS 26 had no fix until this week. Those tend to be the hand-me-down phones and front-desk iPads nobody checks. KEV deadlines only bind US federal civilian executive branch agencies, but the list is a useful priority list for everyone.

What to do today

Which update each device needs, from Apple’s notes:

Our own comparison, not an Apple statement: iPads listed in Apple’s 26.7.2 notes but not in its 27.2 notes are the iPad 8th generation, iPad Air 3rd generation, iPad Pro 12.9-inch 3rd generation, iPad Pro 11-inch 1st generation and iPad mini 5th generation. If you have one, 26.7.2 is the update to look for.

1. Make a list. For each company iPhone and iPad, note the model and version in Settings > General > About, or pull it from your device management tool if you use one.
2. Our advice: update the oldest devices first. On an iPhone XS, XS Max, XR or 7th-generation iPad, Apple’s update guide says to back up, plug in, connect to Wi-Fi, then go to Settings > General > Software Update and tap Download and Install. It should offer 18.7.11.
3. Check everything else is at least 26.7.1. Anything on iOS or iPadOS 26 below 26.7.1 is still exposed to this flaw. Install 26.7.2.
4. Do the Macs. Tahoe needs 26.7.1 or later and Sequoia 15.8.1 or later; the newest are 26.7.2 and 15.8.2. Apple’s Mac update guide says to back up first, then open Software Update in System Settings.
5. Turn on automatic updates. Settings > General > Software Update > Automatic Updates, then Automatically Install.

Steps 1 and 3, and the order in step 2, are our own advice. Apple notes that once an iOS or iPadOS update is installed, it can’t be downgraded. Apple’s notes list no workaround and no signs of compromise.

Updates

• Oct 27, 2026, 1:42 p.m. Manila: First published. We’ll add a dated note if Apple changes its notes, adds fixes for older devices, or reports exploitation of any flaw in the Oct 26 batch, or if CISA changes the KEV entry.

Sources & method

Sources

• Apple, “About the security content of iOS 18.7.11 and iPadOS 18.7.11,” Oct 26, 2026
• Apple, “About the security content of iOS 26.7.1 and iPadOS 26.7.1,” Sep 28, 2026
• Apple, “About the security content of macOS Tahoe 26.7.1,” Sep 28, 2026 and macOS Sequoia 15.8.1
• Apple, Oct 26, 2026 notes: iOS and iPadOS 27.2, iOS and iPadOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, tvOS 27.2, watchOS 27.2 and visionOS 27.2
• Apple, “About the security content of iOS 18.7.10 and iPadOS 18.7.10,” Aug 17, 2026
• Apple security releases
• Apple, “Update your iPhone or iPad” and “Update macOS on Mac”
• CVE-2026-86950 record (CNA: Apple; CISA ADP score) and NVD entry
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-86950, added Sep 29, 2026 and KEV data feed (JSON)
• CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” Sep 29, 2026
• CISA Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk,” June 10, 2026

Method. Checked October 27, 2026, between 1:00 and 1:42 p.m. Manila time (05:00–05:42 UTC). The device lists, CVE IDs, impacts, dates and the exploitation statement come from Apple’s security notes and its security releases list; the 27.2 figure is our count of CVE entries on Apple’s page. The fixed-version list and the 8.8 score come from the CVE record. The KEV date, due date and ransomware field come from CISA’s KEV data feed (catalog version 2026.10.26). The list of iPads that get 26.7.2 but not 27.2 is our own comparison of Apple’s two device lists. Apple’s 18.7.11 page lists the affected devices with a garbled line; we used the device list on Apple’s security releases page (iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation). Steps marked as our advice are our own judgment. We used no press coverage or third-party research. No affiliate links on this page. How we work.