Apple Zero Days 2026 List: Apple Flagged 2 CVEs, but CISA Added 10 Apple Flaws to KEV

Apple zero days 2026 list, as of November 5, 2026: Apple’s security pages flag 2 CVEs first patched this year as possibly exploited, CVE-2026-20700 in dyld (February 11) and CVE-2026-86950 in CoreGraphics (September 28), against 7 in the same window of 2025. CISA added 10 Apple CVEs to KEV in 2026, and 8 of them carry no such Apple sentence.

Apple’s security releases page for dates; CISA KEV catalog version 2026.11.04. Hover a mark for the CVE and release. The red dashed line at Oct 13 falls 13 days before iOS 18.7.11 reached iPhone XS and XR.

The complete list: every CVE Apple flags as exploited in 2026

All dates 2026. Patch dates from Apple’s security releases page. Apple adds that CVE-2025-14174 and CVE-2025-43529, fixed December 12, 2025, “were also issued in response to this report”.

The February entry shows how much a fixed-by list can leave out. Apple says the dyld attack hit “versions of iOS before iOS 26”, and yet no iOS 18 page we parsed lists CVE-2026-20700, though Apple shipped iOS 18.7.5 the same day. Apple does not say why. iPhone XS, XS Max and XR cannot run iOS 26, so for this attack chain the document trail on those phones stops at the December fixes. The September entry did reach them, as iOS 18.7.11 on October 26, 2026, 28 days after iOS 26.7.1.

8 more Apple CVEs CISA added in 2026, with no exploitation sentence

KEV dates are all 2026. “No exploitation wording” means our parse found neither Apple’s sentence nor a named exploit in any entry for that CVE on Apple’s pages since 2021.

Apple has a second, newer way of saying it. On March 11, 2026, it shipped iOS 15.8.7 and iOS 16.7.15 with entries reading “This fix associated with the Coruna exploit was shipped in” a named iOS version, covering CVE-2023-41974, CVE-2023-43000, CVE-2023-43010, CVE-2024-23222. Six days earlier CISA had listed 2 of them. On April 1 it widened iOS 18.7.7 so that automatic updates would deliver “important security protections from web attacks called DarkSword”, and said the fixes “first shipped in 2025”, without naming CVEs on that page. Neither note uses Apple’s exploitation sentence, so a count built on that sentence misses both, apart from CVE-2024-23222, which Apple flagged in 2024. We keep them out of the 2, and we name them here because a list without them would mislead.

The slowest listing is CVE-2024-27834, a WebKit flaw patched on May 13, 2024 and added to KEV on November 4, 2026, 905 days later. The one 2026 ID in this table, CVE-2026-65400 in macOS Screen Sharing, was patched on August 6, 2026, listed 12 days later with a 3-day deadline, and appears on Apple’s pages with no exploitation note. Our analysis of the CISA KEV catalog shows how far KEV reaches beyond any vendor’s own flags.

2026 against 2021 to 2025, same parse and same window

*2026 is partial. Year is the date of the first Apple page listing the CVE, which can precede the flag. WebKit includes JavaScriptCore and WebKit Storage. Kernel includes XNU. Component and wording columns cover the whole year. KEV launched on November 3, 2021, so 2021 has no lag median.

The phrasing changed along the way. Through 2024 Apple wrote “may have been actively exploited” or “may have been exploited”. Then “extremely sophisticated attack against specific targeted individuals” took over: 8 of 9 flagged CVEs in 2025, and both in 2026, against 0 before 2025. The sentence describes who Apple says was targeted, not how far a technique travelled. The Coruna and DarkSword notes are the evidence on that point: fixes from 2023 to 2025 were still being pushed to more devices in 2026.

Days from patch to KEV listing

One dot per flagged CVE first patched after KEV launched on November 3, 2021; every 2021 flag was patched before that. Gray tick: yearly median. Log scale. Days are KEV date minus first Apple page date.

Across the 46 flagged CVEs since KEV launched, the median gap is 2 days, and 41 were listed within a week. Both 2026 CVEs took one day. All 4 over 30 days have entries Apple added after release, such as CVE-2022-48618, patched December 13, 2022 with its entry added on January 9, 2024. Every one of the 64 flagged CVEs is now in KEV, including CVE-2025-14174, which CISA lists under Google, not Apple. Our zero-day statistics measure the same patch-to-KEV gap across Project Zero’s whole tracker.

Which components get hit

Component is the heading Apple uses on the page. WebKit includes JavaScriptCore and WebKit Storage. Kernel includes XNU.

WebKit has 30 of the 64 flagged CVEs (47%) and the kernel has 11 (17%). WebKit’s share fell from 50% in 2021 to 2023 to 38% since 2024. Neither 2026 CVE is in either component. CVE-2026-86950 is the second CoreGraphics flag in the series, after CVE-2021-30860 in 2021, credited to The Citizen Lab. On credit: Apple names Google for 18 of the 64, an anonymous researcher for 23, itself for 7, Kaspersky for 3, and The Citizen Lab for 3. CVE-2026-86950 is Meta’s first credit in the set.

Backports to older OS versions

Days from the first page listing the CVE to the last page on an older iOS or iPadOS line (iOS 12 to iOS 18 and iPadOS 17, depending on the year). Mac backports are not in this table. *2026 is partial.

Median days to the last older iOS or iPadOS fix were 3 in 2023 and 0 in 2024, when Apple mostly shipped them together, then 26 in 2025 and 28 in 2026, though 2026 rests on one CVE. The longest gap in the set is 779 days: CVE-2024-23222, patched January 22, 2024, reached iOS 15.8.7 on March 11, 2026, in the Coruna backport. Of the 11 flagged CVEs since 2025, 3 have no older line on Apple’s pages at all, and a flaw can be absent from an old version, so read those rows as “no document”, not “exposed”.

Explore every flagged CVE since 2021

Gray rows: in CISA’s catalog under Apple, with 2021 or later IDs, and no Apple exploitation sentence. Requires JavaScript; the same rows are in the CSV.

What this means for MSPs

Set minimum OS levels by line, today. The floor for CVE-2026-86950 is iOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, and iOS 26.7.1 and Tahoe 26.7.1 sit above the February 26.3 fix. For iPhone XS, XS Max, XR and iPad 7th generation, the floor is iOS 18.7.11, a line with no listed CVE-2026-20700 fix. iPhone 8 and X are at iOS 16.7.16 and iPhone 6s and 7 at iOS 15.8.8, both May 11, 2026, and macOS Sonoma at 14.8.9, August 6. None of those three pages lists either 2026 CVE. Mark those devices as replace-now for any client with admin users. Our iOS version data and Mac version data show what a typical fleet looks like against those floors.

Enforce it through declarative device management, with a date. In Intune, Microsoft now calls the older MDM update policies deprecated and points to Declarative Device Management, where “Enforce Latest Delay in Days” sets the deadline. That needs iOS and iPadOS 17 or macOS 14, so iPhone 8 and X sit outside it. Pair it with a compliance rule: “Minimum OS version” alone can miss a same-version security build, because Microsoft notes Apple typically changes the build number, so use “Minimum OS build version” as well. A 14-day delay would have matched the CVE-2026-86950 federal deadline. If a client wants to follow KEV, CISA gave CVE-2026-65400 three days, so write a shorter ring for internet-facing Mac services.

Rapid Security Responses are now Background Security Improvements, so check the setting. Apple’s documents use the new name, from iOS 26.1, iPadOS 26.1 and macOS 26.1, while the deployment keys and Microsoft’s Intune pages keep the old one. On supervised devices, set InstallSecurityUpdate to AlwaysOn in SoftwareUpdateSettingsAutomaticActionsObject, and set EnableRollback to FALSE in SoftwareUpdateSettingsRapidSecurityResponseObject so users cannot remove them. To force one, Apple’s guide requires TargetOSVersion and TargetBuildVersion in SoftwareUpdateEnforcementSpecific. Report them through StatusDeviceOperatingSystemSupplementalExtraVersion and StatusDeviceOperatingSystemSupplementalBuildVersion. For Intune’s minimum build rule, Microsoft says to enter the supplemental build version.

Do not plan around them for zero days. Apple’s list shows one Background Security Improvement in 2026, on March 17, 2026, for WebKit CVE-2026-20643, which carries no exploitation sentence. Neither 2026 zero day shipped that way: both came as full point releases. In Apple’s records since 2021, one flagged CVE has shipped through this channel, CVE-2023-37450, as Rapid Security Response 16.5.1 (c) in July 2023. And Apple warns that these releases apply only to the latest minor version and “don’t adhere to the managed software update delay”, while a delayed minor update also delays them. A long deferral ring blocks the fast channel too, so keep deferrals short.

Track KEV as well as Apple’s wording. On Apple’s sentence alone, a client would have seen 2 events this year. CISA’s feed adds 8 more, including a macOS Screen Sharing flaw with a 3-day deadline. Add Apple’s KEV entries to the same alert, and remember that most of them are old CVEs: a fleet at the current floor is already covered, and the action is finding devices still below it.

Frequently asked questions

How many Apple zero days have there been in 2026?

2 as of November 5, 2026, if a zero day means a CVE first patched in 2026 with Apple’s own “may have been exploited” sentence: CVE-2026-20700 in dyld and CVE-2026-86950 in CoreGraphics. The same window of 2025 had 7. CISA added 10 Apple CVEs to its KEV catalog in 2026, and 8 of those carry no such sentence.

What is the oldest iPhone that still gets security updates?

The iPhone 6s. Apple’s list shows iOS 15.8.8 on May 11, 2026 for iPhone 6s, iPhone 7 and iPhone SE (1st generation), and iOS 16.7.16 the same day for iPhone 8 and iPhone X. The newest release for an older iPhone is iOS 18.7.11 on October 26, 2026, for iPhone XS, XS Max and XR. iPhone 11 and later run iOS 26 or 27.

What is the latest Apple security update?

As of November 5, 2026, Apple’s security releases page shows iOS 27.2 and iOS 26.7.2 and iOS 18.7.11, and macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, all dated October 26, 2026, among 115 entries so far in 2026. The newest update with Apple’s exploitation sentence is iOS 18.7.11, for CVE-2026-86950.

How long after an Apple patch does CISA list a zero day?

Both 2026 CVEs reached KEV one day after Apple’s patch. Across the 46 flagged CVEs patched since KEV launched in November 2021, the median is 2 days, and 41 were listed within a week. Federal deadlines were 21 days for CVE-2026-20700 and 14 days for CVE-2026-86950.

Which Apple component has the most zero days?

WebKit, with 30 of 64 flagged CVEs since 2021 (47%), then the kernel with 11. Neither 2026 CVE is in WebKit or the kernel: dyld and CoreGraphics are the components. WebKit was 50% of flagged CVEs in 2021 to 2023 and 38% from 2024 on.

How do I avoid Apple zero-day exploits?

Require the current minor release with an MDM deadline, and keep Background Security Improvements on. CVE-2026-86950 needs iOS 26.7.1, macOS Tahoe 26.7.1 or Sequoia 15.8.1, or iOS 18.7.11 on iPhone XS and XR. Apple’s page lists no iOS 18 fix for CVE-2026-20700, so move those devices to hardware that runs iOS 26 or later when a client’s risk justifies it.

Methodology

References

1. Apple, Apple security releases, with archives for 2022 to 2023 and 2020 to 2021. Accessed November 2026.
2. Apple, security content of iOS 26.3 and iPadOS 26.3, iOS 26.7.1 and iPadOS 26.7.1, iOS 18.7.11 and iPadOS 18.7.11, iOS 16.7.15, iOS 18.7.7 and iPadOS 18.7.7. Accessed November 2026.
3. Apple, About Background Security Improvements for iOS, iPadOS, and macOS and security content of Background Security Improvements. Accessed November 2026.
4. Apple Platform Deployment, Background Security Improvements on Apple devices. Accessed November 2026.
5. CISA, Known Exploited Vulnerabilities Catalog (JSON feed). Accessed November 2026.
6. Microsoft Learn, Configure Update Policies for Apple Devices and iOS/iPadOS device compliance settings. Accessed November 2026.
7. Google Project Zero, “0day In the Wild” tracking spreadsheet. Accessed October 2026.
8. SOC Prime, CVE-2026-20700 (2025 count cross-check). Accessed November 2026.