Apple security updates for iOS and iPadOS and macOS, October 2026: one out-of-bounds write fixed

The release at a glance

Apple released its October 2026 security updates for iOS and iPadOS and macOS on 20 October 2026. The release covered by this page contains one CVE, CVE-2026-86944, and it is the only entry in the table. No vendor severity rating is available in the data used for this page, and the CVE record has no CVSS base score, so the release is recorded as unscored. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalogue and no exploitation is reported in the available public data.

The update covers three platform lines: iOS and iPadOS, macOS Sequoia, and macOS Tahoe. Although the CVE count is small, it affects devices before those fixed versions across both mobile and desktop estates. There are no CVEs in this release that CISA or Apple has marked as exploited.

What matters most

Only one vulnerability needs attention in this release: CVE-2026-86944. Apple describes it as an out-of-bounds write that was addressed with improved bounds checking. An app may be able to cause unexpected system termination. The described trigger is an app, not a remote network request.

Affected products and versions:

• iOS and iPadOS before 26.7
• macOS before Sequoia 15.8
• macOS before Tahoe 26.7

Apple fixes it in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, and macOS Tahoe 26.7. No CVSS score or Apple severity rating is available in the data used for this page. The public EPSS signal is 0.2% (4th percentile). No CWE identifiers are listed for the flaw.

Because this is the only CVE in the release, it ranks first by default, but unpatched devices on any of the affected branches may be disrupted by an app that triggers the out-of-bounds write. Prioritise devices where users can install or run third-party apps; these are the devices most directly exposed to the app-based trigger. The fix is available for all affected branches, so no product line is left waiting.

Patch in this order

With one CVE and no exploited or KEV-listed entries, the priority list is short:

1. Update all managed iPhones and iPads to iOS 26.7 and iPadOS 26.7.
2. Update Macs to macOS Sequoia 15.8 or macOS Tahoe 26.7, depending on the installed release line.
3. Within those updates, start with devices where users can install or run third-party apps, then complete the rest of the estate inside your normal patch window.

Because CVE-2026-86944 is not in CISA KEV, there is no CISA due date for remediation. The published fixes are the OS updates to the versions listed above.

Beyond the patch

A one-CVE Apple release is easy to treat as routine, but it is still a useful checkpoint for how well you track vendor patch cycles across a mixed estate of iPhones, iPads and Macs. Our Supply Chain Defense & Third-Party Risk service helps you keep an accurate view of which vendors' software you run and how quickly you absorb their fixes, so a small update does not slip because the asset list is out of date. For organisations working to NIS2 / DORA frameworks, that kind of vendor patch tracking is an expected control rather than an optional extra.