Apple security updates for iOS and iPadOS, macOS and visionOS, October 2026: one high-severity WebKit flaw leads 39 fixes

The release at a glance

Apple published security updates for iOS and iPadOS, macOS and visionOS on 26 October 2026 covering 39 CVEs. Apple assigns one high severity and leaves 38 unscored. None of the issues is marked exploited or appears in CISA's KEV catalogue. The release spans 32 iOS and iPadOS CVEs and 7 Safari CVEs.

What matters most

Safari and WebKit. CVE-2026-112637 is the only CVSS-scored issue in the release, at 8.8 high. It is a use-after-free in WebKit: processing maliciously crafted web content may lead to arbitrary code execution. It is fixed in Safari 27.2, iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2.

iOS and iPadOS. The remaining high-priority items either need a privileged position or local code execution, but matter for device and identity management. CVE-2026-112518 is a signature validation weakness that could permit an attacker in a privileged network position to impersonate a Kerberos KDC; it is fixed in iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2. CVE-2026-112459 is a race condition an app can use to terminate the system or corrupt kernel memory, fixed in iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2 and watchOS 27.2. CVE-2026-112507 is an out-of-bounds write, iOS and iPadOS only, with the same kernel-writing outcome. CVE-2026-112567 lets a malicious app bypass Privacy preferences, and CVE-2026-112500 can leak a user's original email address when using Hide My Email. CVE-2026-112432, a logging issue, could allow an app to access sensitive user data. CVE-2026-112595 allows an attacker in physical proximity to craft malicious network traffic and gain access to a Thread network.

Patch in this order

1. Apply the WebKit fix first. Update Safari to 27.2, iOS and iPadOS to 27.2, macOS to Golden Gate 27.2, and tvOS, visionOS and watchOS to 27.2 to close CVE-2026-112637, the sole high-severity issue and the only WebKit code-execution flaw in the release.
2. Patch identity and local network access next. CVE-2026-112518 (Kerberos KDC impersonation) is fixed in iOS and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2 and watchOS 27.2. CVE-2026-112595 (Thread network access) is fixed in iOS and iPadOS 27.2, macOS Golden Gate 27.2 and tvOS 27.2.
3. Move to kernel and privacy fixes. Apply iOS and iPadOS 27.2 for CVE-2026-112459, CVE-2026-112507, CVE-2026-112567, CVE-2026-112500 and CVE-2026-112432. For macOS, apply Golden Gate 27.2, and for CVE-2026-112567 also Sequoia 15.8.2 or Tahoe 26.7.2; tvOS 27.2, visionOS 27.2 and watchOS 27.2 close their respective kernel and privacy items.
4. Complete the update cycle. The same Apple releases cover all 39 CVEs: 32 affect iOS and iPadOS, and 7 affect Safari.

Beyond the patch

This is a routine Apple patch cycle: no exploited or KEV-listed issues, but one high-severity WebKit flaw and many local privilege and privacy fixes. The work is manageable if you treat Apple's cadence as part of your exposure window. Supply Chain Defense & Third-Party Risk helps track which Apple platforms you run and how quickly the update reaches them, while Managed Detection & Response (MDR) can monitor for code execution or credential abuse in case any unpatched device is targeted before the update completes.