Full Breakdown
Apple Releases Massive Security Update, Addressing 329 Vulnerabilities Across Its Ecosystem
By Drooid · · How we work
Apple’s Latest Security Update Sweep
On Monday, Apple published a coordinated set of software updates for iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari. The company refreshed its security releases page to detail the fixes included in the releases, which span the current iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2 streams.
Scope of Vulnerabilities Fixed
Apple’s advisory lists 329 unique security vulnerabilities addressed in the batch, which together map to 1,265 CVE entries. The iOS 26.7.2 and iPadOS 26.7.2 updates alone contain 134 distinct fixes, none flagged as known to be exploited in the wild. In addition to the core updates, Apple back-ported a high-severity CoreGraphics flaw to older operating-system versions (iOS 18.7.11, iPadOS 18.7.11, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2).
Notable Flaws and Backported Patches
- CoreGraphics (CVE-2026-86950) – an out-of-bounds write with a CVSS score of 8.8 that can enable arbitrary code execution when a malicious file is processed. Apple notes a report that the flaw may have been used in “an extremely sophisticated attack” against targeted individuals on iOS versions prior to iOS 27.
- CoreMedia (CVE-2026-86990) – could allow a malicious app to access the camera on iPhone, iPad, Mac, or Vision Pro without user permission.
- Apple Intelligence (CVE-2026-86987) – an authorization issue that could let a remote attacker retrieve sensitive user data.
- Audio logic issue (CVE-2026-65339) – may enable an app to leak user information.
- Siri vulnerability (CVE-2026-43736) – could expose sensitive data on macOS Tahoe.
Apple’s Official Position
The company emphasizes that the newly released patches extend protection to older devices that cannot run the latest iOS 26 release, and it recommends that all users install the updates via Settings -> General -> Software Update (or the equivalent path on Mac and Apple TV).
Implications for Users
The breadth of the update—covering core operating systems, the Safari browser, and emerging platforms like Vision Pro—highlights Apple’s ongoing response to a surge of vulnerabilities, many discovered through AI-assisted research. By back-porting fixes to legacy devices, Apple aims to mitigate risk for users of older hardware that remain in active use. Updating promptly remains the primary safeguard against the disclosed flaws.