Skip to content

Back to the catalog

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
securityweek.comarticle

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple's 27.2 releases fix 286 vulnerabilities across iOS/iPadOS (163) and macOS Golden Gate (263), with memory corruption in WebKit and the kernel, sandbox escapes, Gatekeeper bypasses and a remote code execution bug in Remote Management. iOS and iPadOS 18.7.11 backport the fix for CVE-2026-86950, an exploited zero-day found by Meta's product security team and first patched in 26.7.1. Patch counts for tvOS, watchOS, visionOS, Safari and the 26.7.2 and Sequoia 15.8.2 releases are also listed.

TL;DR Apple ships iOS and macOS 27.2 with 286 fixes and backports the exploited CVE-2026-86950 fix to iOS 18.7.11.
Open original ↗
Document

What it is

Apple's 27.2 security releases fix 286 vulnerabilities across iOS and macOS Golden Gate. The same batch backports the fix for CVE-2026-86950, an exploited zero-day that Apple called an "extremely sophisticated attack", to iOS and iPadOS 18.7.11. Meta's product security team found the flaw. The page gives no technical detail on the bug itself.

Preconditions / Affected

CVE-2026-86950 was first patched in late September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Devices on the 26 line or macOS 15 that skipped those releases were exposed. iOS and macOS 27 do not appear to be affected. The 18.7.11 backport is the first fix for devices stuck on iOS 18, and it covers three vulnerabilities in total.

Other fixes the page names:

  • iOS and iPadOS 27.2: memory corruption in WebKit, the kernel, and image, font, PDF, audio and video handling, some allowing arbitrary code execution. Also WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that lets a nearby attacker access a Thread network.
  • macOS Golden Gate 27.2: more than a dozen privilege escalation flaws that give apps root, sandbox escapes, Gatekeeper bypasses, and kernel memory corruption in file system and disk image components.
  • macOS network services: Screen Sharing, Remote Management and SMB bugs reachable remotely or from the local network. One Remote Management bug allows remote arbitrary code execution.

What to do

Install the release that matches each device's OS line:

Device or OS lineUpdate toVulnerabilities fixed
iOS / iPadOS 2727.2163
iOS / iPadOS 2626.7.2134
iOS / iPadOS 1818.7.113
macOS Golden Gate27.2263
macOS Tahoe26.7.2213
macOS Sequoia15.8.2197

Other releases are tvOS 27.2 (72), watchOS 27.2 (62), visionOS 27.2 (125) and Safari 27.2 (33).

Prioritise Macs running Screen Sharing, Remote Management or SMB, because of the remote code execution and network-reachable bugs.

Caveats

The page says no public information describes the attacks that exploited CVE-2026-86950. It does not say which component the flaw sits in. Roughly 140 of the fixed bugs are shared between iOS and macOS 27.2, so the two totals overlap.

Organisations named here

  • memory corruption
  • Meta

CVEs named here

  • CVE-2026-86950

Technologies named here

  • macOS Golden Gate 27.2
  • iOS and iPadOS 27.2
  • iOS and iPadOS 18.7.11
  • iOS and iPadOS 26.7.2
  • macOS Tahoe 26.7.2
  • macOS Sequoia 15.8.2
  • tvOS 27.2
  • watchOS 27.2
  • visionOS 27.2
  • Safari 27.2
  • Screen Sharing, Remote Management and SMB in macOS
  • Kerberos KDC
  • Thread network
  • iOS
  • macOS
  • Safari
  • Kerberos
  • WebKit

Techniques named here

  • WebContent sandbox escapes
  • Kerberos KDC impersonation
  • Nearby attacker access to a Thread network
  • Privilege escalation giving apps root access
  • Gatekeeper bypasses
  • Remote code execution via a Remote Management bug
  • Sandbox escape
  • Gatekeeper bypass

Related in Mobile Security