The software updates Apple released on 26 October – iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS, watchOS and visionOS 27.2, Safari 27.2 and updates for older systems – come with a long list of security fixes, according to Apple’s security releases page. Counted across all the advisories, the updates address at least 329 distinct vulnerabilities, a tally made by 9to5Mac. Apple notes in its advisories that more CVE entries may be added later.
One of the most notable fixes is in CoreMedia (CVE-2026-86990): according to Apple’s iOS 27.2 advisory, a malicious app could have accessed the camera without the user’s permission. The same bug is fixed on the Mac. Another flaw, in Apple Intelligence (CVE-2026-86987), could let a remote attacker access sensitive user data on iPhone 15 Pro and later and on supported iPads.
On the Mac, the macOS Tahoe 26.7.2 update closes a Siri hole (CVE-2026-43736) through which an app could reach sensitive user data, while Safari 27.2 brings a batch of WebKit fixes for maliciously crafted web content.
Owners of older devices are covered too. iOS 18.7.11 and iPadOS 18.7.11 for iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad bring a CoreGraphics fix (CVE-2026-86950) for a flaw that could allow arbitrary code execution from a maliciously crafted file. Apple says it is aware of a report that the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
As usual, the simplest protection is to install the update: go to Settings > General > Software Update on iPhone and iPad, or System Settings > General > Software Update on a Mac. For what else is new in this release, see our iOS 27.2 overview. Earlier this year, Apple also patched flaws used by the Coruna and DarkSword exploit kits.