One day. Every major Apple platform. At least 329 unique security vulnerabilities, now patched. Released on October 26, 2026, the update sweep covers iPhones, iPads, Macs, Apple Watch, Apple TV, Apple Vision Pro, and Safari. If you use any Apple device for banking, work email, or two-factor authentication, prompt action is warranted.
What Got Fixed
Apple’s October 26 release spans current and older supported operating-system branches across every major platform the company ships.
The release covers current and older supported Apple operating-system branches, including:
- iOS/iPadOS 27.2, 26.7.2, and 18.7.11
- macOS Golden Gate 27.2, Tahoe 26.7.2, and Sequoia 15.8.2
- watchOS 27.2 and tvOS 27.2
- visionOS 27.2 and Safari 27.2
Note: tvOS 26.6.1, released for Apple TV HD and first-generation Apple TV 4K, carries no published CVE entries in Apple’s advisory.
You may see the figure 1,265 CVE listings cited alongside this release. That number reflects how the same underlying flaw appears across multiple platform advisories when a shared component like WebKit is affected. The more meaningful figure, per 9to5Mac, is 329 unique vulnerabilities. Apple may revise that count as it updates its advisories after publication.
The Vulnerabilities Worth Knowing
Several of the patched flaws carry real-world consequences for camera privacy, sensitive data access, and browser-based code execution.
A malicious app could access your camera without permission on iPhone, iPad, Mac, and Apple Vision Pro, according to Apple’s advisory for CVE-2026-86990, a CoreMedia flaw addressed in this release.
CVE-2026-86987 affects supported iPhone and iPad models: a remote attacker could reach sensitive user data through an Apple Intelligence vulnerability. A separate Siri flaw on macOS Tahoe, CVE-2026-43736, could similarly allow an application to access sensitive user data.
The iOS and iPadOS 18 updates carry a fix for CVE-2026-86950, a CoreGraphics vulnerability involving maliciously crafted files and arbitrary code execution. Apple previously warned this flaw may have been exploited in highly targeted attacks against individuals on versions before iOS 27.
WebKit received more than 30 fixes across the release, addressing arbitrary code execution via malicious web content, sandbox escapes, and memory corruption, according to MacRumors. Apple’s published advisories did not identify the newly listed WebKit flaws as exploited in the wild. Several findings are credited to AI-assisted discovery tools and external research teams; credited discovery does not by itself indicate active exploitation.
Update Now, Check Again Later
Installing the applicable update promptly is the clearest action available to reduce your exposure across any affected device.
Install the applicable update now, particularly on devices used for sensitive communications, financial activity, or business access. Apple lists every affected product and CVE at support.apple.com/en-us/100100.
Do not assume older branches are exempt. Apple released iOS/iPadOS 26.7.2 and 18.7.11 for older supported device generations specifically, and those updates carry meaningful security content. Safari users on macOS Sequoia or Tahoe should update to Safari 27.2 through System Settings.
Apple may revise these advisories after initial publication as additional CVE entries are added. Treat the security releases page as a living source throughout any patch-management cycle.
