Apple Fixes 286 Flaws, Backports Exploited Zero-Day
Apple fixed 286 vulnerabilities in iOS and macOS 27.2 and backported a fix for the exploited CVE-2026-86950 zero-day to iOS 18.
Apple released security updates for its latest operating systems, fixing 286 vulnerabilities across iOS and macOS 27.2. The company backported a fix for CVE-2026-86950 to iOS 18 after the vulnerability was exploited in what Apple described as an “extremely sophisticated attack.”
The iOS and iPadOS 27.2 updates fix 163 flaws. macOS Golden Gate 27.2 fixes 263. About 140 vulnerabilities are shared by the two operating systems, producing 286 unique flaws overall.
The iPhone and iPad updates fix memory corruption bugs in WebKit, the kernel and components that process images, fonts, PDF files, audio and video. Some of these flaws could allow attackers to run arbitrary code. Other fixes prevent apps from accessing sensitive data, bypassing privacy settings or escaping the WebContent sandbox.
Apple fixed a Kerberos Key Distribution Center impersonation flaw and a bug that could let a nearby attacker access a Thread network.
The macOS update includes more than a dozen privilege-escalation fixes that could allow apps to gain root access. It fixes sandbox escapes, Gatekeeper bypasses and kernel memory corruption bugs in file-system and disk-image components.
The update addresses vulnerabilities in Screen Sharing, Remote Management and SMB that could be exploited remotely or over a local network. One Remote Management flaw could let a remote attacker run arbitrary code.
iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950. Meta’s product security team discovered the flaw. Apple first fixed it in late September with iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said iOS and macOS 27 are not affected.
Apple has not released details about the attacks that exploited CVE-2026-86950 beyond describing them as extremely sophisticated. The company released iOS and iPadOS 26.7.2 with 134 fixes, macOS Tahoe 26.7.2 with 213 and macOS Sequoia 15.8.2 with 197.
tvOS 27.2 fixes 72 vulnerabilities, watchOS 27.2 fixes 62, visionOS 27.2 fixes 125 and Safari 27.2 fixes 33.
Articles by this author
