Apple iOS, iPadOS and macOS security updates, October 2026: one out-of-bounds write fixed

The release at a glance

Apple published its October 2026 security updates for iOS and iPadOS and macOS on 20 October 2026. The release contains one CVE, CVE-2026-86944. No CVSS score is listed for it, and it is not present in CISA's Known Exploited Vulnerabilities catalogue. No exploitation has been reported, and there is no public disclosure.

The flaw is an out-of-bounds write that Apple addressed with improved bounds checking. An app may be able to cause unexpected system termination. Affected products are iOS and iPadOS before 26.7, macOS before 15.8 for the Sequoia line, and macOS before 26.7 for the Tahoe line. Fixed versions are iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, and macOS Tahoe 26.7. This is the only vulnerability in the release, and no separate advisories are associated with it. The release is classified as unscored. The EPSS score is 0.2, at the 4th percentile.

What matters most

Only one CVE is in scope for this release: CVE-2026-86944. It affects two Apple product families.

iOS and iPadOS: versions before 26.7 are affected. Apple has fixed the issue in iOS 26.7 and iPadOS 26.7.

macOS: two release lines require attention. macOS Sequoia before 15.8 is affected and fixed in macOS Sequoia 15.8. macOS Tahoe before 26.7 is affected and fixed in macOS Tahoe 26.7.

The underlying issue is a memory-safety flaw, an out-of-bounds write. In Apple's description, an app may be able to cause unexpected system termination. The stated impact is limited to unexpected system termination. No CVSS score, CWE, or vendor severity rating is provided for this CVE. EPSS is 0.2, at the 4th percentile, which indicates low estimated exploitation likelihood. It is not listed in CISA KEV, has no reported exploitation, and has not been publicly disclosed.

Patch in this order

Because this release contains one non-exploited CVE and no KEV entries, the priority is straightforward.

1. Apply the Apple updates to devices in your estate: iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, and macOS Tahoe 26.7.
2. Confirm installation on all managed Apple endpoints. There is no CISA KEV due date, and no exploitation has been reported, so this fits a routine change window.
3. Record the patch against affected assets in your configuration management database or patch management system, so the cycle is auditable and comparable with future Apple releases.

Beyond the patch

A single-CVE Apple release is still a supplier patch cycle. Your exposure window is set by which iOS and macOS versions are present in your estate and how quickly updates are applied. Supply Chain Defense & Third-Party Risk tracks vendor patch cadence and the exposure associated with third-party platforms, so routine releases like this become a measured item in the risk register rather than an ad hoc fire drill. For teams reporting under EU frameworks, the same evidence supports patch management reporting in NIS2 / DORA frameworks.