A bug in a core part of Apple's systems let attackers who already had a foothold run their own code. Apple says it was used against specific people. Apple fixed it in macOS Tahoe 26.3 and iOS 26.3.
- Status
- Patched: update now
- Being attacked?
- Yes[1]
- Severity
- High
- Updated
Apple says it may have been used in an extremely sophisticated attack against specific people. CISA lists it as used in real attacks (added Feb 12, 2026). Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .
Am I affected?
You are at risk if your Mac runs macOS Tahoe older than 26.3 or your iPhone runs iOS 26 older than 26.3.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| macOS | Mac | macOS Tahoe before 26.3 | 26.3 (Tahoe)[1] |
| iPhone and iPad (iOS) | iPhone / iPad | iOS and iPadOS 26 before 26.3 | iOS 26.3[2] |
How to check your version
These checks only look. They do not change anything on your computer.
macOS on Mac
Easy way: Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
sw_vers -productVersion
iPhone and iPad (iOS) on iPhone / iPad
Easy way: On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.
How to fix it
- Click the Apple menu > System Settings > General > Software Update.
- Install the update it offers.
- Restart your Mac when asked.
- On iPhone or iPad: Settings > General > Software Update.
More on each app: Is my Mac up to date?, Is my iPhone up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/apple-attacked-bug-feb-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-20700
Sources
- MakerApple: About the security content of macOS Tahoe 26.3 (Feb 11, 2026)
- MakerApple: About the security content of iOS 26.3 and iPadOS 26.3 (Feb 11, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-20700 (added 2026-02-12) (Feb 12, 2026)
- NVDNVD: CVE-2026-20700 (Feb 11, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.