CISA Adds CVE-2026-86950 to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The vulnerability affects Apple Multiple Products and is classified as an out-of-bounds write flaw. Out-of-bounds write vulnerabilities are a frequent attack vector for malicious cyber actors and can allow arbitrary code execution, privilege escalation, or denial of service.

CISA's Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. Under this directive, FCEB agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. The directive also establishes expectations for agencies to check whether threat actors had compromised the system before a patch was applied.

While BOD 26-04 applies specifically to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria of evidence of active exploitation and a clear mitigation path.