Apple has released backported security patches for older iPhones and iPads to address a zero-day bug in CoreGraphics, which was exploited in sophisticated targeted attacks.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2025-20701 | 8.8 | HIGH | No | - |
| CVE-2026-20700 | 7.8 | HIGH | Yes, added 2026-02-12 | 2026-03-05 |
| CVE-2026-86950 | 8.8 | HIGH | Yes, added 2026-09-29 | 2026-10-13 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations are advised to install these patches to protect against potential data corruption or remote code execution, as the vulnerability could be exploited in highly targeted attacks.
Industries affected
This issue affects a wide range of industries, including finance, healthcare, and government, where sensitive data and critical operations are handled on iOS devices.
Users affected
Users of older iPhones and iPads are particularly affected, as these devices were not originally patched for this vulnerability. Installing the updates is crucial to prevent any potential security breaches.
Build these skills
Sources
- Apple backports CoreGraphics zero-day patches to older iPhones (BleepingComputer)
