Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Other Devices
Summary: Apple released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates on Wednesday to fix CVE-2026-20700, a memory corruption issue in dyld, Apple's Dynamic Link Editor, that carries a CVSS score of 7.8 and could let an attacker with memory write capability execute arbitrary code. Apple said the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26, and credited Google's Threat Analysis Group with discovering and reporting it.
Key Takeaway: This is Apple's first actively exploited zero-day of 2026, after the company patched nine exploited-in-the-wild zero-days last year, and the advisory ties it to two earlier flaws, CVE-2025-14174 and CVE-2025-43529, both scored 8.8 and fixed in December 2025. The exploitation was aimed at specific targeted individuals rather than the general population, which puts the question of who in your organization fits that profile ahead of a routine patch cycle.