Apple Resolves Decade-Old iOS Zero-Day Vulnerability Exploited in the Wild

Apple has addressed a significant zero-day vulnerability in iOS that has affected all versions since its inception. Known as CVE-2026-20700, the flaw was discovered by Google’s Threat Analysis Group and is related to the dynamic linker, or dyld. This vulnerability allows attackers to execute arbitrary code through memory write capabilities. Notably, the exploit was documented as being used in highly sophisticated attacks against selected individuals.

Details of the iOS Zero-Day Vulnerability

According to Apple, this vulnerability may have been part of a broader exploit chain. The company’s advisory noted that an attacker with the ability to write to memory could potentially execute arbitrary code. Reports also indicate that the vulnerability had been exploited in the wild, affecting versions of iOS prior to iOS 26.

Technical Insights

Brian Milbier, deputy CISO at Huntress, explained the importance of dyld in iOS security. He likened it to a ‘doorman’ that ensures only verified applications can be executed. The attack allows an aggressor to bypass standard security checks, ultimately gaining unrestricted access to the system.

Impact and Chaining of Vulnerabilities

Milbier emphasized the sophistication of this attack, which resembles exploits developed for use within the surveillance industry. These exploits, including tools like Pegasus and Predator, are often sold to government entities.

• CVE-2026-20700: A critical vulnerability affecting dyld.
• Associated with sophisticated attacks on targeted individuals.
• Exploited in combination with WebKit flaws fixed in iOS 26.3.

Additional Security Patches

In addition to addressing the zero-day vulnerability, Apple’s updates for iOS and iPadOS included numerous fixes for other bugs. These include vulnerabilities that provide root access or leak sensitive user data. However, CVE-2026-20700 remains a significant concern as the only flaw reported to be actively exploited.

The Road Ahead

With the release of iOS 26.3, Apple has closed a door that had remained open for more than a decade. The company continues to respond to security threats proactively, ensuring users are protected from evolving attack strategies.