Apple Zero-Day Tracker.

This page holds short security alerts about Apple zero-day vulnerabilities and the updates that fixed them. It covers 8 items from April 2022 to November 2026. Each entry keeps its first title, date and text. The newest come first, grouped by quarter. The old web addresses of these entries now lead to the matching entry here.

Jump to: 2026 Q4 | 2024 Q1 | 2023 Q3 | 2022 Q4 | 2022 Q2

2026 Q4

CISA Adds Patched Apple Pointer Authentication Bypass CVE-2024-27834 To KEV

Published: 4 November 2026.

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on 4 November 2026, with a due date of 18 November 2026. The flaw is in WebKit. It lets an attacker who already has arbitrary read and write capability bypass Pointer Authentication.

Apple fixed the bug on 13 May 2024 in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. Sekoia names it as the Pointer Authentication step in an iOS 16.7 exploit chain of a watering hole campaign that it attributes to APT29 with moderate to high confidence.

Read the CVE-2024-27834 reference page for the version table, or our post on the APT29 mobile watering hole.

iOS 18.7.11 Update For iPhone XS, XS Max And XR

Published: 26 October 2026.

Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October 2026. The update fixes CVE-2026-86950, an out-of-bounds write in CoreGraphics. Apple says the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Apple fixed the same bug on 28 September 2026 for newer devices. The iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation waited another four weeks. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 September 2026.

Read our news post, iOS 18.7.11 update for iPhone XS, XS Max and XR, or the CVE-2026-86950 reference page.

2024 Q1

Apple Releases Urgent Updates To Address Actively Exploited Zero-Day Vulnerabilities

Published: 7 March 2024.

Apple has released urgent updates for two actively exploited zero-day vulnerabilities. These vulnerabilities, CVE-2024-23225 and CVE-2024-23296, pose major risks. Attackers with arbitrary kernel read and write features can bypass kernel memory protections. Apple has addressed these issues with improved validation methods in iOS 17.4, iPadOS 17.4, iOS 16.7.6, and iPadOS 16.7.6.

The updates cover a wide range of Apple devices. These include iPhones and iPads. Examples are iPhone 8 and later, and iPad Pro models from the 2nd generation onwards. This is the third time this year that Apple has tackled actively exploited zero-day vulnerabilities. Earlier, Apple addressed a confusion flaw in WebKit.

It could lead to arbitrary code execution across some Apple platforms. These include iOS, iPadOS, macOS, tvOS, and Safari web browser.

Meanwhile, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two extra vulnerabilities. It urges prompt updates to reduce possible risks. These vulnerabilities cover two flaws. One is an information disclosure flaw hitting Android Pixel devices (CVE-2023-21237). The other is an operating system command injection flaw in Sunhillo SureLine (CVE-2021-36380). It could result in code execution with root privileges.

For CVE-2023-21237 there are signs of limited, targeted exploitation. A Mirai botnet was earlier revealed to use CVE-2021-36380. So addressing these vulnerabilities remains critical to bolstering the overall cybersecurity posture.

2023 Q3

Apple Releases Urgent Patches To Address Zero-Day: Actively Exploited In The Wild

Published: 25 July 2023.

Apple has released emergency security updates for some devices, including iPhones, iPads, Macs, Apple Watch, Apple TV and Safari. These updates fix some security vulnerabilities, including a zero-day bug actively used in the wild.

The specific vulnerability, tracked as CVE-2023-38606, affects the kernel. It allows a harmful application to possibly alter the private kernel state. Apple has addressed this issue with improved state management. The company knows that this bug is actively used. It affects iOS versions released prior to iOS 15.7.

This is the third vulnerability linked to Operation Triangle, an advanced cyberespionage campaign. It has targeted iOS devices since 2019. Two other zero-days, CVE-2023-32434 and CVE-2023-32435, were patched by Apple the previous month.

Security updates are available for a variety of iOS and iPadOS devices, including:

• iPhone 8 and later.
• iPad Pro (all models).
• iPad Air 3rd generation and later.
• iPad 5th generation and later, and.
• iPad mini 5th generation and later.

Also covered are:

• Apple TV 4K (all models), Apple TV HD, and.
• Apple Watch Series 4 and later.
• macOS Ventura 13.5.
• macOS Monterey 12.6.8, and.
• macOS Big Sur 11.7.9.

With this latest release, Apple has addressed a total of 11 zero-day vulnerabilities hitting its software since the beginning of 2023.

This update follows the company’s emergency fixes two weeks ago. They covered an active bug in WebKit that could lead to arbitrary code execution (CVE-2023-37450).

Attacks can be carried out using the vulnerability. To avoid them, it is advised to use up-to-date versions that fix the vulnerability.

Operation Triangle

Security experts have uncovered an advanced, targeted cyberattack that uses Apple’s mobile devices. The attack is named “Triangulation.” It aims to plant covert spyware into the iPhones of staff of certain firms. These include middle and top management staff.

The cyberattack employs an invisible iMessage carrying a harmful attachment. The attachment uses many vulnerabilities within the iOS operating system. It runs on the device and stealthily installs the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays private data back to remote servers. This includes microphone recordings and instant messenger photos. It also includes geolocation and other user activity data. Read the Operation Triangulation analysis.

Apple Releases Update For 0-Day Vulnerability

Published: 12 July 2023.

Critical Vulnerability

Apple; has released security updates that fix the 0-day vulnerability hitting iOS, macOS, and iPadOS operating systems. The vulnerability affects the WebKit browser engine. Many products use it to show web content.

The vulnerability is tracked by code CVE-2023-37450 . It has a high severity rating. It allows threat actors to generate harmful web content and run arbitrary code on the target system.

Apple confirmed reports of active exploitation of the vulnerability. It fixed it with improved controls. But after the security updates, Safari browser (versions before 16.5.2) stated that some apps gave an “Unsupported Browser” error. These apps include Facebook, Instagram, and Zoom.

The vulnerability affects versions earlier than:

• iOS 16.5.1.
• iPadOS 16.5.1.
• macOS Ventura 13.4.1, and.
• Safari 16.5.2.

Apple has released updates that fix security vulnerabilities with critical risk levels. Users using vulnerable versions are advised to upgrade to updated versions as soon as possible.

Be Careful for Your Apple Devices

“Triangulation Trojan” Launches Sophisticated Attack on Apple Devices

Security experts have uncovered an advanced, targeted cyberattack that uses Apple’s mobile devices. The attack is named “Triangulation.” It aims to plant covert spyware into the iPhones of staff of certain firms. These include middle and top management staff.

The cyberattack employs an invisible iMessage carrying a harmful attachment. The attachment uses many vulnerabilities within the iOS operating system. It runs on the device and stealthily installs the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays private data back to remote servers. This includes microphone recordings and instant messenger photos. It also includes geolocation and other user activity data. Read the Operation Triangulation analysis.

2022 Q4

Critical 0-Day Alarm On iOS And iPadOS

Published: 26 October 2022.

Apple has released updates to 20 security vulnerabilities hitting iOS and iPadOS operating systems, including a 0-day vulnerability known to be actively exploited by threat actors.

The 0-day vulnerability, tracked as CVE-2022-42827, exists due to a boundary error. The error hits the “Kernel” part of the operating system. Threat actors can trigger an out-of-bounds write error through a crafted application. This lets them run with root privileges on the vulnerable system.

Apart from the vulnerability mentioned above, Apple has also fixed two high-severity vulnerabilities. They came with the released iOS 16.1 and iPadOS 16 updates. Attacks can be carried out using vulnerabilities. To avoid being a target, Apple users should apply the published updates at once. This matters most for those on vulnerable versions.

2022 Q2

A Critical Security Vulnerability Detected In Apple M1 Processor: “PACMAN”

Published: 12 June 2022.

A new security vulnerability targeting Apple’s popular M1 processor has been found. Experts at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) found it. It is called PACMAN. The attack is intended to circumvent the Pointer Authentication (PAC) method in M1 and other ARM-based processors.

PAC is a security feature. It helps protect against threat actors that have gained memory access to the CPU. Pointers store memory addresses. The PAC checks for unexpected pointer changes caused by an attack.

The PACMAN vulnerability is in a hardware method. So it is estimated that a software update cannot remedy it. What makes the PACMAN vulnerability dangerous is that it directly affects the core. The core is the most privileged part of the operating system. Endangering the core means a threat actor can do everything the user can in a vulnerable system.

PACMAN can be triggered if there is any software vulnerability in the system. But there is no risk of endangering systems on their own. For example, memory corruption is one of the vulnerabilities that can cause PACMAN to be triggered. Apple users must keep their operating systems and software up-to-date.

New Zero Click Vulnerability Detected Affecting iOS Operating System

Published: 21 April 2022.

Citizen Lab digital security experts have detected a new zero click iMessage vulnerability. It is used to install Pegasus spyware on the iPhone devices of Catalan politicians, journalists, and activists. The Israeli firm NSO builds Pegasus. It markets Pegasus to governments as licensed software for investigating terrorist actions.

Attacks with Pegasus spyware hit high-level authorities of many states. Examples are the United Kingdom and Finland. Between 2017 and 2020, Pegasus targeted at least 65 people. It abused the Kismet iMessage vulnerability and a vulnerability in Whatsapp. Many people are among the recently observed campaign targets.

They include Catalan members of the European Parliament, heads of state, judges, lawyers, and journalists.

The zero-click vulnerability, called HOMAGE, affected some versions before iOS 13.2 and was fixed in iOS 13.2. Apple officials stated that users on the current version of iOS are not affected by the HOMAGE exploit. Spyware installed on target systems without any user interaction (zero-click) has many features. It can read messages on devices and listen to calls. It can capture user passwords and track location. It can also access the device’s microphone and camera.

The campaign in question has not yet been attributed to any state or threat actor. But the findings show that threat actors affiliated with the Spanish government carried it out. To avoid attacks that can be carried out using the said vulnerability and harmful software, keep the device/system or programs in the latest version. Also, download apps from official sources, and use a full anti-malware solution.