Apple October 2026 security updates: 119 CVEs led by five high-severity WebKit flaws

The release at a glance

On 26 October 2026, Apple published security updates for iOS and iPadOS, macOS and visionOS. The release is documented on Apple's security release page. In total, 119 CVEs are in scope for our readers. Apple rates five as high severity and nine as medium; 105 are currently unscored. By product, 93 affect iOS and iPadOS and 26 affect Safari. The fixed versions named in the advisory include iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, Safari 27.2, tvOS 27.2 and watchOS 27.2. None of the CVEs appears in CISA's Known Exploited Vulnerabilities catalogue, and the release lists no exploited CVEs.

What matters most

Five WebKit flaws lead the release. CVE-2026-112623, CVE-2026-112651 and CVE-2026-112659 are use-after-free or type confusion issues in Safari before 27.2, iOS and iPadOS before 26.7.2 or before 27.2, macOS before 27.2, and visionOS before 27.2. CVE-2026-112626 and CVE-2026-112655 are the same class of use-after-free and additionally affect tvOS before 27.2 and watchOS before 27.2. In each case, processing maliciously crafted web content may lead to arbitrary code execution; the CVSS 3.1 base score is 8.8, with a network attack vector, low complexity, no privileges required but user interaction required.

CVE-2026-113913 is a medium-severity input validation issue that may disclose sensitive information when processing web content. It affects iOS and iPadOS before 26.7.2 or before 27.2, macOS before Golden Gate 27.2, Sequoia 15.8.2 or Tahoe 26.7.2, and visionOS before 27.2.

Two further medium-severity memory safety issues are worth noting. CVE-2026-112415 is an out-of-bounds write in iOS, iPadOS, macOS and visionOS; an app may be able to cause unexpected system termination or corrupt process memory. CVE-2026-112614 is an out-of-bounds write in image handling fixed in iOS, iPadOS and macOS; processing a maliciously crafted image may lead to unexpected app termination.

Patch in this order

1. Apply Safari 27.2 first on every managed Mac and, through the operating system update, to iOS and iPadOS browser use. This closes the five high-severity WebKit flaws rated 8.8.
2. Deploy the paired operating system updates: iOS 26.7.2 and iPadOS 26.7.2, or iOS 27.2 and iPadOS 27.2; macOS Golden Gate 27.2, macOS Sequoia 15.8.2 or macOS Tahoe 26.7.2; and visionOS 27.2.
3. Update tvOS and watchOS to 27.2 where CVE-2026-112626 and CVE-2026-112655 apply.
4. Roll the remaining medium and unscored fixes through the same patch cycle. There are no CISA KEV entries or exploited CVEs in this release that would create a separate emergency path. Because the WebKit flaws can be triggered by a user visiting a malicious website, treat them as high priority even though no active exploitation is known. For unmanaged devices, instruct users to install the latest iOS, iPadOS, macOS, visionOS, tvOS or watchOS update as appropriate.

Beyond the patch

A release of 119 CVEs without active exploitation is a patch sequencing challenge rather than an incident. The practical work is confirming that every managed iPhone, iPad, Mac and Apple TV actually receives the update, and Managed Detection & Response helps by watching for signs of attempted code execution from the WebKit flaws, so a missed device becomes a finding rather than a breach. Tracking the update as part of your patch cadence also supports NIS2 / DORA frameworks obligations around timely remediation.