---
title: "Apple fixes 329 security vulnerabilities across iOS, macOS and Safari"
description: "Apple's advisories list a camera-access bug, an Apple Intelligence data flaw and a fix for an exploited iOS 18 bug."
url: https://mactoreality.com/apple-fixes-329-security-vulnerabilities-across-ios-macos-and-safari
published: 2026-10-27T11:43:13Z
updated: 2026-10-27T11:43:13Z
author: "Mac to Reality Newsdesk"
category: News
tags: ["Privacy & security","Software"]
publisher: Mac to Reality
ai_assisted: true
apple_heat_impact: -1
---

# Apple fixes 329 security vulnerabilities across iOS, macOS and Safari

*Apple's advisories list a camera-access bug, an Apple Intelligence data flaw and a fix for an exploited iOS 18 bug.*

**Key points**

- Apple's 26 October system updates address at least 329 unique security weaknesses across iOS, iPadOS, macOS, watchOS, tvOS, visionOS and Safari.
- A CoreMedia vulnerability (CVE-2026-86990) could give a malicious app unauthorised camera access on iPhones, iPads, Macs and Apple Vision Pro.
- An Apple Intelligence flaw (CVE-2026-86987) could let remote attackers obtain sensitive data on supported iPhones and iPads.

The software updates Apple released on 26 October – iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS, watchOS and visionOS 27.2, Safari 27.2 and updates for older systems – come with a long list of security fixes, according to Apple’s security releases page. Counted across all the advisories, the updates address at least 329 distinct vulnerabilities, a tally made by 9to5Mac. Apple notes in its advisories that more CVE entries may be added later.

One of the most notable fixes is in CoreMedia (CVE-2026-86990): according to Apple’s iOS 27.2 advisory, a malicious app could have accessed the camera without the user’s permission. The same bug is fixed on the Mac. Another flaw, in Apple Intelligence (CVE-2026-86987), could let a remote attacker access sensitive user data on iPhone 15 Pro and later and on supported iPads.

On the Mac, the macOS Tahoe 26.7.2 update closes a Siri hole (CVE-2026-43736) through which an app could reach sensitive user data, while Safari 27.2 brings a batch of WebKit fixes for maliciously crafted web content.

Owners of older devices are covered too. iOS 18.7.11 and iPadOS 18.7.11 for iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad bring a CoreGraphics fix (CVE-2026-86950) for a flaw that could allow arbitrary code execution from a maliciously crafted file. Apple says it is aware of a report that the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

As usual, the simplest protection is to install the update: go to Settings > General > Software Update on iPhone and iPad, or System Settings > General > Software Update on a Mac. For what else is new in this release, see our iOS 27.2 overview. Earlier this year, Apple also patched flaws used by the Coruna and DarkSword exploit kits.

## Sources

- [Apple: Apple security releases](https://support.apple.com/en-us/100100)
- [Apple: About the security content of iOS 27.2 and iPadOS 27.2](https://support.apple.com/en-us/149230)
- [9to5Mac: Apple addressed at least 329 unique security vulnerabilities across today's system updates](https://9to5mac.com/2026/10/26/apple-addressed-at-least-329-unique-security-vulnerabilities-across-todays-system-updates/)

*This report was written by the Mac to Reality newsdesk with AI assistance from the sources listed above, under the editorial policy at https://mactoreality.com/editorial-policy.*