Apple fixes two high-severity flaws that allow code execution via malicious websites or Bluetooth
Apple has patched two vulnerabilities rated CVSS 8.8, CVE-2026-86922 and CVE-2026-86919, that could let attackers run arbitrary code through malicious web content or a paired Bluetooth device. They affect iPhone, iPad, Mac, Safari and visionOS and are fixed in the latest updates.
What happened
Apple has shipped updates that fix two high-severity vulnerabilities, both rated CVSS 8.8. Each one can lead to arbitrary code execution on the device, though they are exploited in different ways. The details come from NVD, which points to Apple's security advisories, including the one for iOS 27 and iPadOS 27, released on September 14, 2026.
CVE-2026-86922 is a type confusion flaw in the handling of web content. If a victim opens a specially crafted page, attackers can run code on their device. The attack works remotely and needs no credentials, but the user has to visit the malicious site.
CVE-2026-86919 is a stack overflow caused by insufficient input validation. According to the description, an attacker with a Bluetooth device already paired with the target could execute arbitrary code. No user interaction is required, but the attacker must be physically nearby and have a prior pairing.
Who is affected
According to NVD, the fixes are included in the versions listed below, so devices that have not yet installed them remain exposed. Apple's advisory for iOS 27 and iPadOS 27 states that this release is available for iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
- CVE-2026-86922 (web content): fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27 and visionOS 27.
- CVE-2026-86919 (Bluetooth): fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and visionOS 27.
Exploitation status
Neither vulnerability is listed in CISA's KEV catalog, which tracks flaws with confirmed active exploitation, and no public exploit is known. FIRST estimates the probability of exploitation over the next month at 0.1% for CVE-2026-86922 and 0.2% for CVE-2026-86919, so exploitation is considered unlikely for now. Even so, their severity means updates should not be delayed.
What to do
Update all Apple devices to the fixed versions and use your mobile device management (MDM) tool to confirm compliance.
- iPhone and iPad: install iOS 27 or iPadOS 27, which fix both flaws. iOS 26.7 and iPadOS 26.7 fix CVE-2026-86919, but the available data does not list them as fixing CVE-2026-86922.
- Mac: macOS Golden Gate 27 fixes both flaws. macOS Sequoia 15.8 and macOS Tahoe 26.7 are listed as fixing CVE-2026-86919, so also install Safari 27 to address the web flaw.
- Apple Vision Pro: update to visionOS 27.
- Review your inventory for devices that cannot run these versions and plan to replace or isolate them.
- Until updates are rolled out, review and remove unrecognised Bluetooth pairings and avoid pairing unknown devices.
Sources
Affected technologies
Vulnerabilities (2)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-86919 | High (8.8) | — | 10/19/2026 | Awaiting Analysis |
| CVE-2026-86922 | High (8.8) | — | 10/19/2026 | Awaiting Analysis |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.