VULNpocalypse
HighVulnerabilityPatch available

Apple iOS 27.2, macOS 27.2 and Safari 27.2 fix 163 CVEs, including a WebKit sandbox escape (CVE-2026-112697, CVE-2026-113897)

Apple’s 26 October updates fix 163 CVEs in iOS 27.2, including WebKit code execution and a sandbox escape. Update iOS, macOS, Safari and older-device builds.

Published
Updated
Fixed in
iOS and iPadOS 27.2, 26.7.2, 18.7.11; macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2; Safari 27.2; tvOS, watchOS and visionOS 27.2
Exploitation
No exploitation stated for the 27.2 fixes; CVE-2026-86950, backported to iOS 18.7.11, is in CISA KEV since 29 September 2026

Live scores

CVE-2026-112697
EPSS
0.002
low predicted chance of attack
VEDAS
0.051
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-113897
EPSS
0.003
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-113952
EPSS
0.002
low predicted chance of attack
VEDAS
0.052
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-112615
EPSS
0.002
low predicted chance of attack
VEDAS
0.047
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-112659
EPSS
0.006
low predicted chance of attack
VEDAS
0.054
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-112637
EPSS
0.005
low predicted chance of attack
VEDAS
0.053
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-86987
EPSS
0.002
low predicted chance of attack
VEDAS
0.046
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-86950
EPSS
0.262
likely to be attacked soon
VEDAS
0.972
strong exploit evidence
On CISA KEV
Yes, since 2026-09-29
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-86950 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-86950 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

On 26 October 2026, Apple released iOS and iPadOS 27.2, 26.7.2 and 18.7.11, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, Safari 27.2, and tvOS, watchOS and visionOS 27.2. Xcode 27.2 followed on 29 October (Apple security releases).

iOS 27.2 alone lists 163 CVEs (Apple, iOS 27.2). About 30 are in WebKit and its sub-components, with two more in WebRTC, and 15 are in the kernel. Safari 27.2 for macOS Tahoe and Sequoia carries 33 of them (Apple, Safari 27.2). The ones that matter most for defenders:

  • CVE-2026-112697 (WebKit): a use-after-free where processing malicious web content may lead to arbitrary code execution. Also fixed in iOS 26.7.2 (CVE record).
  • CVE-2026-113897 (WebKit Process Model): “a remote attacker may be able to break out of Web Content sandbox”. Apple fixed it by removing the vulnerable code (CVE record). A sandbox escape is the second half of a typical browser exploit chain.
  • CVE-2026-113952 (WebKit): a website could use a media format that Lockdown Mode should block. Relevant if you put at-risk staff in Lockdown Mode (Apple, iOS 27.2).
  • CVE-2026-86987 (Apple Intelligence): an authorization issue that may let a remote attacker access sensitive user data, on iPhone 15 Pro and later and recent iPads (Apple, iOS 27.2).

Several WebKit bugs were found with AI help. Chris Rohlf with Anthropic Research is credited on CVE-2026-112615, CVE-2026-112659 and CVE-2026-112637. OpenAI Codex Security is credited on CVE-2026-112697 and CVE-2026-112659 (Apple, iOS 27.2).

Apple does not say any of the 27.2 bugs were exploited (Apple, iOS 27.2). The exception is in iOS 18.7.11, which backports the fix for CVE-2026-86950, a CoreGraphics out-of-bounds write. Apple is aware of a report that it may have been exploited “in an extremely sophisticated attack” against targeted people on versions before iOS 27 (Apple, iOS 18.7.11). It was first fixed in September and has been in CISA’s KEV catalog since 29 September 2026 (The Hacker News; CISA KEV). iOS 18.7.11 is for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation.

Am I affected?

Any device below the versions above is affected. On a Mac:

bash
# macOS version
sw_vers -productVersion

# Safari version (Tahoe and Sequoia get the WebKit fixes through Safari 27.2)
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Pending Apple updates
softwareupdate --list

On iPhone and iPad, check Settings, General, About. For a fleet, pull OS versions from your MDM inventory and look for anything older than 27.2, 26.7.2 or 18.7.11.

Also check Macs that are not in your MDM: CI build machines, self-hosted macOS runners and test devices. Apps built on WebKit, including in-app browsers on iOS, use the system WebKit, so the OS update is what fixes them.

What to do now

  1. Update iPhones and iPads to iOS/iPadOS 27.2. Devices on the 26 line can take 26.7.2. iPhone XS, XS Max, XR and iPad 7th generation need 18.7.11 for the exploited CoreGraphics fix.
  2. Update Macs to Golden Gate 27.2, or to Tahoe 26.7.2 or Sequoia 15.8.2 plus Safari 27.2. Check the Safari version afterwards, because the WebKit fixes on those releases are listed under Safari 27.2.
  3. Update tvOS, watchOS and visionOS devices to 27.2, including meeting-room Apple TVs and shared headsets.
  4. Rebuild CI and test images. Self-hosted macOS runners and Mac build hosts need the same OS and Safari updates, and update Xcode to 27.2 on build machines.
  5. For staff in Lockdown Mode, prioritise their devices, because CVE-2026-113952 weakens a Lockdown Mode media restriction.

Sources