Apple's 26 October security updates: iOS and iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, and Safari 27.2 fix WebKit code-execution bugs, a WebContent sandbox escape and, on macOS, a kernel flaw that could let an unprivileged attacker run code as root
Apple released security updates on 26 October 2026 for iOS and iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, tvOS 27.2, watchOS 27.2 and visionOS 27.2, according to its security releases page. Apple's notes for iOS 27.2 list WebKit bugs where processing maliciously crafted web content may lead to arbitrary code execution, an App Store flaw (CVE-2026-112690, credited to Claudio Bozzato and Francesco Benvenuto of Cisco Talos) that may let a remote attacker break out of the WebContent sandbox, and a range of kernel and driver bugs that may let an app corrupt or write kernel memory.
The same App Store fix appears in iOS 26.7.2 and all three macOS updates, and iOS 26.7.2 also fixes an ImageIO bug (CVE-2026-64759) where processing a maliciously crafted image may lead to arbitrary code execution.
On the Mac, Apple says a Kernel flaw (CVE-2026-112438) fixed in macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2 may let an unprivileged attacker execute arbitrary code as root; macOS Golden Gate 27.2 also fixes a Remote Management flaw (CVE-2026-112427) that Apple says may let a remote attacker cause arbitrary code execution, along with several bugs that may let an app gain root privileges, break out of its sandbox or bypass Gatekeeper checks. Safari 27.2 brings the WebKit code-execution fixes to macOS Sequoia and macOS Tahoe.
Apple's notes for iOS 27.2, iOS 26.7.2, the three macOS releases and Safari 27.2 do not say any of these flaws have been exploited, and Apple does not publish CVSS scores. The same day Apple also shipped iOS 18.7.11 for older iPhones, which fixes the exploited CoreGraphics flaw CVE-2026-86950 and is covered on that flaw's card.
- Product
- Apple iOS and iPadOS, macOS (Golden Gate, Tahoe, Sequoia), Safari, tvOS, watchOS, visionOS
- Versions
- Fixed: iOS and iPadOS 27.2 (iPhone 11 and later and listed iPads); iOS and iPadOS 26.7.2; macOS Golden Gate 27.2; macOS Tahoe 26.7.2; macOS Sequoia 15.8.2; Safari 27.2 (macOS Sequoia and macOS Tahoe); tvOS 27.2, watchOS 27.2 and visionOS 27.2 (all released 26 Oct 2026).
- CVSS
- not published by Apple
- Exploited in Australia?
- unknown
- Patch to
- Update iPhones and iPads to iOS/iPadOS 27.2 (or 26.7.2 if staying on iOS 26), Macs to macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2, and Safari to 27.2 on Sequoia and Tahoe; update Apple TV, Apple Watch and Vision Pro to 27.2. In managed fleets, push the updates through MDM and check that devices have actually installed them.
- Primary: Apple — About the security content of iOS 27.2 and iPadOS 27.2 (26 Oct 2026)
- Vendor: Apple — Apple security releases
- CVE: CVE-2026-112690, CVE-2026-64759, CVE-2026-112438, CVE-2026-112427, CVE-2026-86950
- Source: Apple — About the security content of macOS Golden Gate 27.2 (26 Oct 2026)
- Source: Apple — About the security content of iOS 26.7.2 and iPadOS 26.7.2 (26 Oct 2026)
- Source: Apple — About the security content of macOS Tahoe 26.7.2 (26 Oct 2026)
- Source: Apple — About the security content of macOS Sequoia 15.8.2 (26 Oct 2026)
- Source: Apple — About the security content of Safari 27.2 (26 Oct 2026)