Apple dyld Zero-Day (CVE-2026-20700) Added to CISA KEV After Targeted Exploitation
Active Exploitation · 5 sources · Updated 4mo ago · First seen Feb 12, 2026
Apple disclosed and patched CVE-2026-20700, a zero-day affecting dyld (Apple’s Dynamic Link Editor) across multiple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, and visionOS). Apple said the issue was exploited in “extremely sophisticated” attacks targeting specific individuals and described the flaw as enabling arbitrary code execution when an attacker already has memory-write capability, indicating use in advanced exploit chains rather than opportunistic mass exploitation.
CISA added CVE-2026-20700 to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation and set a remediation due date of 2026-03-05 for U.S. federal civilian agencies under BOD 22-01, while urging all organizations to prioritize patching. The same CISA KEV update also added three other actively exploited vulnerabilities—CVE-2024-43468 (Microsoft Configuration Manager SQL injection), CVE-2025-15556 (Notepad++ WinGUp updater integrity-check weakness), and CVE-2025-40536 (SolarWinds Web Help Desk security control bypass)—but those are separate issues from the Apple dyld zero-day.
