Apple security updates for iOS and iPadOS, macOS and visionOS, October 2026: 119 fixes led by Safari code execution flaws

The release at a glance

Apple published its October 2026 security updates on 26 October. The release covers 119 CVEs in scope for our readers: 93 affect iOS and iPadOS and 26 affect Safari. Apple rates five as high, nine as medium, and leaves 105 unscored. No CVE in this release is listed in CISA's Known Exploited Vulnerabilities catalogue.

The five high-severity issues are all in Safari and WebKit: four use-after-free and one type confusion flaw can lead to arbitrary code execution when processing maliciously crafted web content. Fixes are available in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Two of the flaws also have fixes in tvOS 27.2 and watchOS 27.2.

What matters most

Safari and WebKit. CVE-2026-112623, CVE-2026-112626, CVE-2026-112651 and CVE-2026-112655 are use-after-free issues; CVE-2026-112659 is a type confusion issue. All five are rated 8.8 high, with a network attack vector and no privileges required, but user interaction is required. That keeps them below a wormable pre-authentication bar, but they are the first priority because Safari and WebKit are widely deployed. Fixes are in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. CVE-2026-112626 and CVE-2026-112655 also list fixes in tvOS 27.2 and watchOS 27.2.

iOS, iPadOS and macOS image and app handling. The most relevant medium-severity items are CVE-2026-112415, an out-of-bounds write that can allow an app to cause unexpected system termination or corrupt process memory; CVE-2026-112614, an out-of-bounds write when processing a maliciously crafted image that may lead to unexpected app termination; and CVE-2026-113913, an input validation issue that may disclose sensitive information when processing web content. All three are rated 6.5 medium and are fixed in iOS 26.7.2 and iPadOS 26.7.2 and iOS 27.2 and iPadOS 27.2. CVE-2026-112415 and CVE-2026-113913 are fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2 and visionOS 27.2. CVE-2026-112614 is fixed in macOS Golden Gate 27.2 and macOS Tahoe 26.7.2.

Patch in this order

1. Patch the WebKit risk first. Apply Safari 27.2, iOS 27.2 or iOS 26.7.2 for iPhone, iPadOS 27.2 or iPadOS 26.7.2 for iPad, macOS Golden Gate 27.2, and visionOS 27.2. These close the five high-severity arbitrary code execution flaws in Safari.
2. Patch older macOS branches. For Macs that cannot move to macOS Golden Gate 27.2, apply macOS Tahoe 26.7.2 or macOS Sequoia 15.8.2 as appropriate to close the image-processing and input-validation issues.
3. Update Apple TV and Apple Watch to tvOS 27.2 and watchOS 27.2 where those devices are in scope, to cover CVE-2026-112626 and CVE-2026-112655.
4. Then complete the remaining Apple updates. The release covers 93 iOS and iPadOS CVEs and 26 Safari CVEs; most are unscored and none has a CISA KEV due date, so apply the standard update cycle and verify the versions.

Beyond the patch

Next month, the same dynamic will repeat: a large batch of memory-safety fixes across Apple's platforms, most unscored and none on CISA KEV. The management task is to know which devices are behind and to apply the update before the next release changes the baseline. Managed Detection & Response (MDR) fits the WebKit code-execution class because if malicious content is opened, EDR and SIEM see the follow-on activity. Supply Chain Defense & Third-Party Risk fits the patch-cycle problem: Apple is a vendor whose release cadence sets your exposure window.