Apple October 2026 updates patch 304 flaws, including prior exploit
Original title: Apple Patches for October 2026, (Mon, Oct 26th)
Already exploited CoreGraphics flaw CVE-2026-86950 now gets iOS 18 fixes; no newly exploited bug is flagged.
Apple released updates covering 304 vulnerabilities, about a month after its previous update, according to the SANS Internet Storm Center. CVE-2026-86950, an already exploited CoreGraphics issue patched earlier, now receives the corresponding iOS 18 fixes. SANS says no new vulnerability in this release is marked as already exploited. Other noted issues include a malicious app accessing the camera without permission and a local attacker reading Keychain items, alongside many memory-corruption, privilege, and denial-of-service fixes.
Unconfirmed: The diary says CVE-2026-86950 was already exploited but does not say whether attacks continue, and affected version ranges are not stated.
- Fixed releases include iOS and iPadOS 27.2, 26.7.2, and 18.7.11.
- macOS updates are Golden Gate 27.2, Tahoe 26.7.2, and Sequoia 15.8.2.
- tvOS, watchOS, visionOS, and Safari 27.2 are also listed.
- CVE-2026-112427 may allow remote arbitrary code execution in Remote Management.
- CVE-2026-112438 may let an unprivileged attacker run code as root.
Impact: Privilege escalation, code execution, data access, or denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2, 26.7.2, and 18.7.11 |
| Apple iPadOS | — | 27.2, 26.7.2, and 18.7.11 |
| Apple macOS | — | Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2 |
| Apple tvOS | — | 27.2 |
| Apple watchOS | — | 27.2 |
| Apple visionOS | — | 27.2 |
| Apple Safari | — | 27.2 |
- 1.Install the listed October 2026 Apple updates, including iOS 18.7.11 for CVE-2026-86950.
- CVEs
- CVE-2026-86950CVE-2026-86990CVE-2026-28864CVE-2022-26704CVE-2026-112410CVE-2026-112413CVE-2026-112414CVE-2026-112415CVE-2026-112416CVE-2026-112417CVE-2026-112421CVE-2026-112423CVE-2026-112424CVE-2026-112425CVE-2026-112427CVE-2026-112428CVE-2026-112429CVE-2026-112430CVE-2026-112432CVE-2026-112434CVE-2026-112438CVE-2026-112441CVE-2026-112442CVE-2026-112443CVE-2026-112444CVE-2026-112446CVE-2026-112447CVE-2026-112449CVE-2026-112451CVE-2026-112453
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-26704 | A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks | 7.8 | 1% | ||
| CVE-2026-112410 | Double-free crash in macOS from a remote attacker | — | — | ||
| CVE-2026-112415 | Out-of-bounds write in Apple OS via a local app | 6.5 group max | — | ||
| CVE-2026-112416 | Out-of-bounds write when processing video on Apple OSes | — | — | ||
| CVE-2026-112417 | Integer overflow in visionOS via crafted 3D model | — | — | ||
CVE-2026-112438+1 related CVE | Logic flaw lets low-priv attacker run code as root on macOS | 8.8 group max | — | ||
| CVE-2026-28864 | This issue was addressed with improved permissions checking | 3.3 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
From the original article
14 min read at isc.sans.eduApple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.