Apple Zero-Day CVE-2026-20700 Patched Across iOS, macOS, and Other Platforms
Apple released security updates for CVE-2026-20700, a zero-day in dyld (the Dynamic Link Editor) that can enable arbitrary code execution when an attacker already has a memory-write capability. Apple said it is aware the issue “may have been exploited” in extremely sophisticated, targeted attacks against specific individuals, and credited Google Threat Analysis Group (TAG) with discovery. Apple also linked the same incident reporting to two earlier vulnerabilities (CVE-2025-14174 and CVE-2025-43529) that were previously addressed.
The fixes were shipped across Apple’s ecosystem, including iOS/iPadOS, macOS (including macOS Tahoe), tvOS, watchOS, and visionOS; impacted device families include iPhone 11 and later and multiple iPad generations, as well as Macs running macOS Tahoe. Canadian Centre for Cyber Security guidance echoed Apple’s warning of potential exploitation and urged rapid patching (e.g., iOS/iPadOS 18.7.5 and 26.3 releases for newer OS lines). Other vendor advisories published in the same period (HPE, Chrome, Intel, Fortinet, Siemens, Dell, CISA ICS, IBM, Red Hat) are unrelated to the Apple zero-day and reflect routine multi-vendor patch activity rather than the specific exploitation event.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Canadian Centre for Cyber Security issues Apple advisory
The Canadian Centre for Cyber Security published advisory AV26-122 on February 11, 2026, summarizing Apple’s security updates and noting that CVE-2026-20700 may have been exploited in the wild. It urged users and administrators to review Apple’s guidance and apply the patches.
Apple releases broad February 2026 security updates
On February 11, 2026, Apple released security updates across iOS, iPadOS, macOS, tvOS, watchOS, and visionOS, fixing numerous vulnerabilities affecting components such as WebKit, Kernel, Foundation, CFNetwork, Bluetooth, Wi‑Fi, and multiple apps and frameworks. The updates included fixes for denial-of-service, memory corruption, data exposure, sandbox escape, and privilege-escalation issues, including CVE-2026-20700.
Apple says CVE-2026-20700 was used in targeted attacks
Apple stated it is aware of reports that CVE-2026-20700 may have been exploited in an 'extremely sophisticated' attack against specific targeted individuals on iOS versions prior to iOS 26. The company did not disclose technical details of the exploitation.
Google TAG discovers dyld zero-day CVE-2026-20700
Google’s Threat Analysis Group identified CVE-2026-20700, an arbitrary code execution flaw in Apple’s dyld component. Apple later credited TAG for the discovery in its February 2026 security updates.
Apple fixes two vulnerabilities later linked to same attack chain
Apple had previously patched CVE-2025-14174 and CVE-2025-43529 in December 2025. In its February 2026 advisories, Apple said CVE-2026-20700 was exploited in the same incidents as those two earlier flaws.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Apple security advisory (AV26-122) - Canadian Centre for Cyber Security
cyber.gc.ca
Open sourceApple fixes zero-day flaw used in 'extremely sophisticated' attacks
bleepingcomputer.com
Open sourceApple Patches Everything: February 2026 - SANS ISC
isc.sans.edu
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple Patches Actively Exploited dyld Zero-Day in iOS and Other Platforms
Apple released security updates to address an **actively exploited zero-day** tracked as **CVE-2026-20700**, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to *iOS 26*. The flaw affects **`dyld` (Apple’s dynamic linker)** and can allow **arbitrary code execution** when an attacker already has **memory write** capability; reporting attributes discovery to **Google’s Threat Analysis Group** and notes it may have been used as part of an exploit chain. Apple shipped fixes across its ecosystem, including *iOS 26.3*, *iPadOS 26.3*, *macOS Tahoe 26.3*, *watchOS 26.3*, *tvOS 26.3*, and *visionOS 26.3*. The same reporting indicates Apple also issued patches tied to the broader report for **CVE-2025-14174** (an out-of-bounds memory access issue in Chrome’s **ANGLE** graphics component on Mac) and **CVE-2025-43529** (a **use-after-free** leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by **patch deployment speed**—particularly where updates rely on end users rather than enforced device management.
Mar 21, 2026
Apple dyld Zero-Day (CVE-2026-20700) Added to CISA KEV After Targeted Exploitation
Apple disclosed and patched **CVE-2026-20700**, a zero-day affecting `dyld` (Apple’s Dynamic Link Editor) across multiple operating systems (**iOS, iPadOS, macOS, tvOS, watchOS, and visionOS**). Apple said the issue was exploited in “**extremely sophisticated**” attacks targeting specific individuals and described the flaw as enabling **arbitrary code execution** when an attacker already has **memory-write capability**, indicating use in advanced exploit chains rather than opportunistic mass exploitation. CISA added **CVE-2026-20700** to the **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of active exploitation and set a remediation due date of **2026-03-05** for U.S. federal civilian agencies under **BOD 22-01**, while urging all organizations to prioritize patching. The same CISA KEV update also added three other actively exploited vulnerabilities—**CVE-2024-43468** (Microsoft Configuration Manager SQL injection), **CVE-2025-15556** (Notepad++ WinGUp updater integrity-check weakness), and **CVE-2025-40536** (SolarWinds Web Help Desk security control bypass)—but those are separate issues from the Apple `dyld` zero-day.
Mar 21, 2026
Emergency Patches for Apple and Google Zero-Day Exploits in Targeted Attacks
Apple and Google released emergency security updates after discovering that zero-day vulnerabilities in their software were being actively exploited in highly targeted attacks. The campaign, attributed to nation-state actors and commercial spyware vendors, focused on high-value individuals rather than the general public. Apple addressed two critical WebKit vulnerabilities, CVE-2025-14174 and CVE-2025-43529, which were exploited in sophisticated attacks against iPhones, iPads, and Macs running iOS versions prior to 26. Google also patched a Chrome vulnerability discovered in collaboration with Apple’s security team and Google’s Threat Analysis Group, indicating a coordinated response to a broader espionage campaign. The Apple updates, released as iOS 26.2 and iPadOS 26.2, fixed the WebKit flaws that allowed arbitrary code execution and memory corruption through malicious web content. These vulnerabilities affected iPhone 11 and later models, as well as several iPad variants. In addition to the WebKit issues, Apple resolved over 30 other vulnerabilities across various components, including the Kernel and Screen Time. Both companies withheld detailed technical information, suggesting ongoing investigations into the attacks. The rapid deployment of these patches underscores the severity and sophistication of the threat, with both Apple and Google urging users to update their devices immediately.
Mar 21, 2026