Apple security updates for iOS and iPadOS, macOS and visionOS, October 2026: one high-severity Safari flaw among 39 CVEs

The release at a glance

Apple released security updates on 26 October 2026 for iOS 27.2 and iPadOS 27.2, Safari 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2. The combined advisory covers 39 CVEs: 32 affect iOS and iPadOS and 7 affect Safari. Only one CVE carries a CVSS score — CVE-2026-112637 at 8.8, high. The other 38 are unscored. No CVE in this release is listed as exploited and none appears in CISA KEV. Other fixed issues include memory handling for malicious video files and 3D models, and several privacy-related flaws.

What matters most

CVE-2026-112637 is the only scored vulnerability: a use-after-free fixed in Safari 27.2 with an 8.8 high CVSS. Processing maliciously crafted web content may lead to arbitrary code execution, so prioritise this on any device used for browsing or opening links. Apple fixes it in Safari 27.2, iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2. It is not reported as exploited.

On iOS and iPadOS, five issues stand out. CVE-2026-112507 is an out-of-bounds write that an app may use to cause unexpected system termination or write kernel memory; it is fixed only in iOS and iPadOS 27.2. CVE-2026-112474 is a use-after-free with similar kernel-memory consequences, fixed across iOS, macOS, tvOS, visionOS and watchOS. CVE-2026-112432 is a logging-data redaction issue where an app may access sensitive user data. CVE-2026-112500 may leak the user's original email address when Hide My Email is used. CVE-2026-112567 lets a malicious app bypass Privacy preferences.

For macOS and network-bound fleets, CVE-2026-112518 is a signature-validation issue: an attacker in a privileged network position may impersonate a Kerberos KDC. Apple fixes it in iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2.

Patch in this order

1. Patch CVE-2026-112637 everywhere first. Install Safari 27.2 and iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2 on any device that browses the web or opens web links. It is the only high-severity issue and can lead to arbitrary code execution from malicious web content.
2. Patch devices that use Kerberos next. Apply iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2 to close CVE-2026-112518, which lets an attacker in a privileged network position impersonate a Kerberos KDC.
3. Patch managed iPhone and iPad fleets for the kernel-memory issues CVE-2026-112507 and CVE-2026-112474. CVE-2026-112507 is fixed only in iOS and iPadOS 27.2; CVE-2026-112474 is fixed across iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2.
4. Roll out the remaining updates to address privacy, data-exposure and memory-corruption issues. This includes CVE-2026-112432, CVE-2026-112500, CVE-2026-112567, CVE-2026-112454 and CVE-2026-112485. Organisations with older macOS releases should note that CVE-2026-112485 and CVE-2026-112567 are fixed in macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2 as well as macOS Golden Gate 27.2. There is no CISA KEV due date for this release because no CVE is listed in KEV.

Beyond the patch

Apple's patch cycle is predictable, so the work is mostly inventory and cadence: know which iOS, iPadOS, macOS and Safari versions are in the estate and how quickly they can be updated. Supply Chain Defense & Third-Party Risk tracks supplier patch exposure across the fleet, and Managed Detection & Response (MDR) watches for the code-execution and credential-abuse activity these flaws could enable until patching is complete.