We handle all your technical problems so you can focus on growing your business.
The back of an iPhone on a wooden table beside the edge of a laptop keyboard.
CybersecurityPractical insight for your business.

Exploited Flaws in iPhones, iPads, Macs and FortiMail: Confirm the Fixes Landed

Apple fixed an iPhone, iPad and Mac flaw on September 28, 2026 that it says may have been used in targeted attacks, and Fortinet has fixed an exploited flaw in its FortiMail email gateway. Which versions to look for, where to check, and what to ask your IT provider.

Kevin R.

11 min read

Photo by Lala Azizli on Unsplash

The takeaway

Check that every company iPhone, iPad and Mac shows a fixed version, flag the ones that cannot get one, and if you run your own FortiMail gateway, upgrade it or turn off IBE and have it checked for signs of a break-in.

On Monday, September 28, 2026, Apple released updates for iPhones, iPads and Macs that fix a flaw it says “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27” (Apple). On Tuesday, September 29, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added that flaw to its Known Exploited Vulnerabilities (KEV) catalog (CISA, Sept. 29). On Thursday, October 1, it added a flaw in Fortinet’s FortiMail email security gateway (CISA, Oct. 1), and Fortinet’s advisory now lists fixed versions.

What KEV means: CISA adds a flaw to this list when it has evidence that attackers are already using it. The catalog’s deadlines bind federal civilian agencies under CISA’s Binding Operational Directive 26-04, not private businesses, but CISA encourages all organizations to “prioritize remediation of KEV Catalog vulnerabilities.”

Apple’s fix has been available since September 28, so this isn’t breaking news. The useful job now is to confirm that the update actually installed on every company device, and to find the few devices that can’t get it.

1. iPhones, iPads and Macs (CVE-2026-86950)

What’s happening: The flaw is in CoreGraphics, the part of Apple’s operating systems that draws images and handles PDF documents (Apple developer documentation). Apple’s notes say: “Processing a maliciously crafted file may lead to arbitrary code execution.” In plain terms, a booby-trapped file could let an attacker run their own code on the device. Apple fixed it in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (iOS and iPadOS notes, Tahoe notes, Sequoia notes).

Apple’s wording is narrow. It describes an attack against “specific targeted individuals,” not a mass campaign, and it hasn’t said who was targeted, by whom, or when. Apple’s own Lockdown Mode guidance says that “most people are never targeted by attacks of this nature.” Still, the fix is free and already out, and CISA lists the flaw as exploited, so it’s worth confirming it’s installed.

What to check: Inventory company-owned and work-used iPhones, iPads and Macs, including personal phones used for work email that your IT tools may not see. Match each device to Apple’s supported releases below. The advisories identify fixes on specific operating-system branches; they do not establish that every older Apple device is vulnerable.

What each device should show:

  • iPhone or iPad on iOS or iPadOS 26: version 26.7.1 or a later supported update. Apple lists it for iPhone 11 and later, iPad (8th generation) and later, iPad Air (3rd generation) and later, iPad mini (5th generation) and later, and iPad Pro 11-inch (1st generation) and 12.9-inch (3rd generation) and later.
  • iPhone or iPad on iOS or iPadOS 27: the latest 27 update, which was 27.0.1 as of October 10, 2026. Apple’s security notes for iOS 27 don’t list this flaw, its exploitation note refers to “versions of iOS before iOS 27,” and its security releases list says 27.0.1 “has no published CVE entries.” Being on the latest release is the safe position either way.
  • Mac on macOS Tahoe 26: version 26.7.1 or a later supported update.
  • Mac on macOS Sequoia 15: version 15.8.1 or a later supported update.
  • Mac on macOS Golden Gate 27: the latest update, which was 27.0.1 as of October 10, 2026. As with iOS 27, Apple’s Golden Gate 27 notes don’t list this flaw, and Apple says 27.0.1 has no published CVE entries.

Absence of this CVE from the version 27 notes is not, by itself, proof that a device is unaffected. Keep supported devices on the latest compatible security update.

Devices that got no update this round:

  • Macs on macOS Sonoma 14. Apple’s security releases list shows no Sonoma update on September 28 or September 14. The most recent one listed is Sonoma 14.8.9, from Thursday, August 6, 2026. Apple hasn’t said whether Sonoma is affected by this flaw, so don’t assume it is or isn’t. Apple’s compatibility lists show that every Mac that can run Sonoma can also run Sequoia, except the 13-inch MacBook Air models from 2018 and 2019. Ask your IT provider which supported system each Mac can run and how to handle models that cannot receive needed security updates.
  • iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation). Apple doesn’t list these for iOS 26. Their most recent listed update, iOS 18.7.10, came out on Monday, August 17, 2026, and nothing was released for them on September 28. Apple hasn’t said whether iOS 18 is affected. Have your provider verify each device’s remaining security-update options before deciding whether replacement is needed.

Where to check:

  • iPhone or iPad: Go to Settings > General > About to see the version (Apple). Settings > General > Software Update shows whether an update is waiting; tap Download and Install (Apple).
  • Mac: From the Apple menu, choose About This Mac to see the macOS name and version (Apple). To update, choose System Settings from the Apple menu, then General > Software Update (Apple).
  • Automatic updates: On an iPhone or iPad, turn on Settings > General > Software Update > Automatic Updates. Apple says that with Automatically Install on, the device installs updates “overnight while charging and connected to Wi-Fi,” so a phone that rarely charges overnight on Wi-Fi can fall behind.
  • If your devices are managed: If your company enrolls its devices in a mobile device management (MDM) service, ask your provider for a report of every device and its OS version. Apple’s management framework also lets IT set an enforcement deadline for an update instead of waiting for each person to tap Install (Apple Platform Deployment).

For anyone who may be personally targeted: Apple’s Lockdown Mode is “designed for the very few individuals who, because of who they are or what they do, might be personally targeted” by some of the most sophisticated digital threats. It limits some features (for example, most message attachment types are blocked), so it isn’t meant for everyone. Apple says to update to the latest software before turning it on.

Ask your provider: “Can you send me a list of every company iPhone, iPad and Mac with its current OS version? Which ones are below the fixed versions, and which ones can’t be updated at all?”

2. FortiMail email gateways (CVE-2026-104286)

Who runs this: FortiMail is Fortinet’s email security gateway. It filters a company’s email for threats, and it can also protect Microsoft 365 and Google Workspace mailboxes. Fortinet sells it as a hardware appliance, as a virtual machine, or as a cloud service (Fortinet). If you aren’t sure whether your mail passes through one, your IT provider will know. This section matters only if it does.

What’s happening: Fortinet’s advisory FG-IR-26-175, first published Thursday, October 1, says the flaw lets an attacker who hasn’t logged in write files onto the gateway’s underlying system by sending crafted web requests. Fortinet rates it critical (CVSS 9.8) and says the flaw “has been reported to be exploited in the wild.” Fortinet says its own product security team found the flaw. It hasn’t said when the attacks began or who is behind them.

Fortinet’s workaround centers on IBE (identity-based encryption), FortiMail’s feature for sending encrypted email. The recipient gets a notification with a link, then registers or logs in on the FortiMail to read the message, with no special software needed (Fortinet documentation). If encrypted messages from your company arrive as a notice with a link to a secure FortiMail page, you use IBE.

The one action: Upgrade. Fortinet lists the fix in FortiMail 8.0.2, 7.6.7 and 7.4.9. There is no fix in the 7.2 line; move to a fixed release on a supported 7.4 or newer branch, not just any 7.4 build. The advisory’s timeline shows a solution update on Monday, October 5. To see your version, sign in to the FortiMail admin console and go to Dashboard > Status; the Firmware version row shows what’s installed (Fortinet documentation).

FortiMail Cloud: Fortinet says it fixed FortiMail Cloud on October 5 by moving it to 7.6.7 or 8.0.2, “hence the FortiMail Cloud customers need not perform any action.” Fortinet added that clarification to the advisory on Wednesday, October 7.

If you can’t upgrade right away: Fortinet’s workaround is to turn off IBE (Encryption > IBE, set IBE Service to off), or to block internet access to the FortiMail webmail interface and allow it only from a trusted private network. The advisory also gives a rule for a web application firewall, if you have one in front of FortiMail. If your company relies on IBE to send encrypted email to clients, turning it off interrupts that, so the upgrade is the better fix.

Check for a break-in, not just the patch: Upgrading closes the hole. It doesn’t remove anything an attacker set up before then. Fortinet’s advisory lists indicators of compromise: two IP addresses and sample entries from the system event and encryption logs. One of those log entries shows an email archive account being added with a remote server as its destination. FortiMail archive accounts can store archived mail on a remote FTP or SFTP server (Fortinet documentation), so ask your provider to look under Email Archiving > Archive Account for any account nobody on your side created. CISA’s catalog entry for this flaw is also flagged for forensic triage, which under its federal directive means agencies must check whether attackers got in, not just patch.

Ask your provider: “Do we have a FortiMail? Is it FortiMail Cloud, or an appliance or virtual machine that we or you manage? What firmware is it on, is IBE turned on, and can the webmail interface be reached from the internet? Have you checked it against Fortinet’s indicators of compromise?”

The short version

  • Compatible iPhones and iPads are on iOS or iPadOS 26.7.1 or later, or on the latest 27 release (27.0.1 as of October 10, 2026).
  • Compatible Macs are on macOS Tahoe 26.7.1 or later, Sequoia 15.8.1 or later, or the latest Golden Gate 27 release.
  • Your provider has checked security-update options for Sonoma Macs, iPhone XS and XR models, and 7th-generation iPads, and identified any devices needing replacement.
  • Staff who use personal phones for work have checked Settings > General > About.
  • If you run your own FortiMail, it’s on 8.0.2, 7.6.7 or 7.4.9 or later within the corresponding supported branch (7.2 moved to one of those fixed releases), or your provider has applied Fortinet’s interim restrictions until it is. Either way, it has been checked against Fortinet’s indicators.
  • If you use FortiMail Cloud, Fortinet says there’s nothing to do.

If you aren’t sure which devices you have or what they’re running, that’s worth finding out before the next alert. NightSquawk Tech offers a free assessment that can help you take stock.

Sources

Editorial note: This article was drafted with AI assistance from the Apple, CISA and Fortinet sources linked above. Version numbers and menu names are as documented on October 10, 2026 and may change. NightSquawk Tech did not test these vulnerabilities or observe the attacks described. It is general information, not legal advice.