Apple has addressed a security vulnerability in iOS 26, iPadOS 26, and macOS 26 that the company confirmed may have been exploited in targeted attacks. The flaw, identified in the graphics engine that renders visuals across Apple devices, was patched in the latest software updates released on Tuesday.

The vulnerability, cataloged as CVE-2026-86950, granted attackers potential access to sensitive personal data by bypassing safeguards in the operating system’s core rendering components. Meta’s product security team reported the issue to Apple, though neither company disclosed specifics about active exploitation or the number of affected devices.

The patch follows another critical fix, CVE-2026-86869, which ironPeak, a Belgian cybersecurity firm, described as a zero-click flaw capable of silently compromising devices through malformed iMessage content. That vulnerability, which could circumvent Apple’s BlastDoor security layer, was resolved in iOS 27, iPadOS 27, and macOS 27. IronPeak credited Niels Hofmans with its discovery, alongside Meta researchers who validated the findings.

According to Apple’s internal metrics, nearly 80% of iPhone users remain on iOS 26, leaving a substantial portion of devices exposed until updates are applied. While the latest OS versions received a separate security patch on Tuesday, they were not impacted by the graphics engine flaw.

Apple has not confirmed whether either vulnerability was leveraged in real-world attacks prior to remediation. The company also declined to comment on potential threat actors, including state-sponsored groups or commercial spyware vendors.

Zack Whittaker, TechCrunch’s security editor, can be reached via encrypted messaging at zackwhittaker.1337 on Signal or by email at zack.whittaker@techcrunch.com.