Apple Issues Emergency Updates to Address Zero-Day Exploit

Apple released emergency security updates after discovering active exploitation of a zero-day vulnerability affecting multiple operating systems. The flaw, identified as CVE-2026-20700, was addressed through patches made available on February 12, 2026.

The vulnerability impacts the Dynamic Link Editor (dyld) component across iOS, iPadOS, macOS, tvOS, watchOS, and visionOS platforms. According to Apple, the issue allows attackers with memory-write access to execute arbitrary code on affected devices.

Apple stated that CVE-2026-20700 had been exploited in the wild in what the company described as “extremely sophisticated” attacks targeting specific individuals. The company credited Google’s Threat Analysis Group with discovering the vulnerability.

Further investigation revealed that CVE-2026-20700 was used together with two previously patched zero-day vulnerabilities, CVE-2025-14174 and CVE-2025-43529, forming a chain of exploits. This combination increased the potential impact on targeted devices.

What the numbers show

• Security updates were released on February 12, 2026
• Patches were included in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3
• Legacy versions patched include iOS 18.7.5, iPadOS 18.7.5, macOS Sequoia 15.7.4, and macOS Sonoma 14.8.4

The updates were distributed for both current and legacy operating system versions. This included iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3, as well as older versions such as iOS 18.7.5 and macOS Sonoma 14.8.4.

The Cybersecurity and Infrastructure Security Agency (CISA) responded by adding CVE-2026-20700 to its Known Exploited Vulnerabilities catalog. This step highlights the vulnerability’s confirmed use in real-world attacks and the need for prompt remediation.

Apple’s security advisory indicated that the exploit chain involving CVE-2026-20700 and the two earlier zero-days had been neutralized through the latest patches. The company recommended that users update their devices as soon as possible to reduce exposure to the vulnerability.

Security researchers continue to monitor for additional activity related to the exploit chain. The coordinated response from Apple and CISA aims to limit the risk to users by ensuring that affected systems receive timely updates.

* This article is based on publicly available information at the time of writing.