Apple Patches Dozens of 2026 Product Flaws
Apple released fixes for over 80 vulnerabilities across iOS, macOS, Safari, and other products, the most severe allowing privilege escalation.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 18 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISecurity's MS-ISAC advisory 2026-027 details a large batch of vulnerabilities patched by Apple across its product line, including Xcode, Safari, visionOS, watchOS, tvOS, and multiple macOS/iOS versions. The most severe issues could allow an attacker or malicious app to elevate privileges, potentially enabling modification of protected system files or full root access. Other notable flaws include kernel memory disclosure, sandbox escapes, Gatekeeper bypass, arbitrary file read/write as root, and several sandboxed/embedded library issues (curl, Apache) that could leak sensitive data or cause denial-of-service conditions.
While the advisory catalogs dozens of individual CVEs spanning privilege escalation, information disclosure, memory corruption, and web content processing flaws, there are currently no reports of in-the-wild exploitation. The vulnerabilities affect a broad swath of Apple's ecosystem, meaning enterprise, government, and consumer users running unpatched versions could be exposed to local privilege escalation, sandbox escape, or data exposure attacks if an attacker gains initial code execution or physical device access.
CISA/MS-ISAC recommends prompt patching following standard testing, along with defense-in-depth measures such as least-privilege enforcement, vulnerability scanning, network segmentation, and enabling anti-exploitation features like Apple's System Integrity Protection and Gatekeeper. Given the absence of confirmed exploitation and the routine nature of this monthly-style patch cycle, this is assessed as a standard, though extensive, vendor patch advisory rather than an active threat campaign.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-privilege-escalation_2026-027
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs