Apple patches 304 vulnerabilities across iOS, macOS and other platforms

Apple shipped patches for 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari on Oct. 26, 2026, about a month after the prior update in its monthly cycle.

9to5Mac’s Oct. 26, 2026 report put the fix count at 329 security flaws, which expand to 1,265 combined CVE listings since a single issue can span multiple operating systems. The outlet said Apple updates its advisories after they first appear and keeps adding entries, so the total may still rise.

Apple said no exploits were active when the patches shipped. Apple pushed the patches through standard over-the-air mechanisms. The latest versions, per Apple Support, are iOS 27.2, iPadOS 27.2, macOS 27.2, tvOS 27.2, watchOS 27.2 and visionOS 27.2, and once installed, users cannot roll back updates for iOS, iPadOS, tvOS, watchOS and visionOS.

Notable flaws in the batch include CVE-2026-86950, a CoreGraphics flaw in which a maliciously crafted file can run arbitrary code. Apple patched the flaw in an earlier update; the current release brings that CoreGraphics patch to iOS 18 and iPadOS 18 devices. The company has warned that the flaw may have been exploited in a sophisticated attack aimed at specific individuals using iOS versions older than iOS 27.

Also fixed: CVE-2026-86990, a CoreMedia flaw that lets a malicious app access the camera with no permission on iPhone, iPad, Mac and Apple Vision Pro. Another fix, CVE-2026-28864, lets a local attacker read items from a user’s Keychain, Apple’s stored-password system.

Other fixes include CVE-2026-86987, an Apple Intelligence flaw that lets a remote attacker reach sensitive data belonging to users of supported iPhones and iPads, and CVE-2026-43736, a Siri flaw in macOS Tahoe through which an app can reach sensitive user data. Apple said its AI tools and research teams helped uncover some of the flaws. The batch covers memory-corruption and privilege-escalation bugs along with remote-code-execution issues in WebKit, Apple’s browser engine, plus denial-of-service bugs, arbitrary code execution and bypasses of Gatekeeper and Privacy preferences. 9to5Mac reported that earlier this year Apple released updates fixing WebKit flaws used by the Coruna and DarkSword exploit kits in chains against older iPhones.

The patched components span Spotlight, the kernel, Mail, AppleAVD, Model I/O and Screen Sharing Server. Gadget Review says the practical risk window opens the moment CVE details are public because those updates touch kernel and system-level code, and the outlet points to immediate patch triage as the response.

Apple’s update of Sept. 14, 2026 fixed 261 CVEs in eight release trains, a tally independent analysts called the company’s largest single patch cycle. iOS 27 and iPadOS 27 held roughly 126 CVEs, 20 of them in the kernel, while macOS Golden Gate 27 addressed 210.

macOS Tahoe 26.7 had 153 CVEs, 26 of them kernel defects; macOS Sequoia 15.8 had 150-plus patches; and iOS 26.7 and iPadOS 26.7 had 80-plus CVEs. Overlap totaled 100 fixes shared by Golden Gate 27 and iOS 27, more than 140 shared by Tahoe 26.7 and Sequoia 15.8, and 70 shared by iOS 26.7 and iOS 27.

Apple’s September security notes flagged none of those vulnerabilities, with SANS ISC finding no in-the-wild exploitation. CVSS scores in the September set peaked at 7.5 HIGH, covering CVE-2026-28930 and CVE-2026-28969, the severity ceiling for that cycle.

Jamf’s Adam Boynton, Senior Enterprise Strategy Manager, told SecurityWeek that placement matters more than raw count and described iOS 27 as kernel-focused rather than browser-focused. “The number of fixes in iOS 27 matters less than where they sit, and this is a kernel release rather than a browser release,” Boynton said. He also said same-day MDM, or mobile device management, support is now standard, which means postponing fleet patches reflects policy rather than missing tooling.

verisq.ai describes timely patching as a core assurance that maps to NIST CSF 2.0 and says it shows an organization can run vulnerability management. The outlet says the impact reaches every enterprise running Apple devices, spanning technology, finance, health care and education firms.

verisq.ai says enterprises should check that every Apple endpoint is running the latest operating system, the one released on Oct. 26, 2026. Teams should feed Apple’s security advisories into vulnerability-management tooling and keep records of patch deployment dates and device inventory for audit reviews. OffSeq Threat Radar says administrators and users should apply the patches without delay and that patching is the only mitigation indicated.