Apple patches 286 iOS and macOS bugs, backports exploited flaw
Original title: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
Apple on Monday updated its operating systems, fixing 286 vulnerabilities in the newest iOS and macOS versions. macOS Golden Gate 27.2 addresses 263 flaws and iOS and iPadOS 27.2 address 163, with about 140 shared, including memory corruption, sandbox escapes, and remote code execution issues. iOS and iPadOS 18.7.11 also fix CVE-2026-86950, which Apple said was exploited in an extremely sophisticated attack and was first patched in late September. Meta's product security team discovered that bug. Further updates cover the 26.7.2 and 15.8.2 lines plus tvOS, watchOS, visionOS, and Safari.
Unconfirmed: Apple and the article give no public details of the attacks that used CVE-2026-86950.
- CVE-2026-86950 was first fixed in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
- iOS and iPadOS 26.7.2 fix 134 flaws; macOS Tahoe 26.7.2 fixes 213; Sequoia 15.8.2 fixes 197.
- tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2 fix 72, 62, 125, and 33 flaws.
- A Remote Management bug in macOS could allow remote arbitrary code execution.
Impact: Code execution, root access, sandbox escape, or data access
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS and iPadOS | 18.x before 18.7.11; also 26.x and 27.x lines receiving updates | 18.7.11, 26.7.2, and 27.2 |
| Apple macOS | — | Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2 |
| Apple Safari | — | 27.2 |
- 1.Install iOS and iPadOS 18.7.11 to receive the CVE-2026-86950 fix.
- 2.Update supported devices to the 27.2, 26.7.2, or 15.8.2 releases Apple listed.
- CVEs
- CVE-2026-86950
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityweek.com
Apple patched 286 vulnerabilities in iOS and macOS 27. 2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.