# Apple ships 304 fixes, no new in-the-wild bugs

Published: 2026-10-26 · Severity: high
Canonical: https://vorant.io/reports/9d4609dc-884d-5b29-8d4a-5b79e3a831f5/apple-ships-304-fixes-no-new-in-the-wild-bugs

> Apple's October 2026 update patches 304 vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS and visionOS; no newly exploited flaws this cycle.

Apple released its October 2026 security updates covering iOS 27.2/26.7.2/18.7.11, iPadOS equivalents, macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2, addressing roughly 304 CVEs. SANS ISC notes the volume is consistent with Apple's typical monthly cadence, arriving about a month after the previous update. The only previously-exploited vulnerability referenced, CVE-2026-86950 (CoreGraphics), was originally patched a month ago for newer OS versions; this release simply backports the fix to iOS 18. No newly flagged actively-exploited vulnerability appears in this update.

Among the hundreds of fixes, defenders should prioritize patching kernel memory corruption and privilege-escalation issues (multiple 'gain root privileges' bugs in Security, StorageKit, SecurityAgent, CVMS, configd, and Crash Reporter), numerous WebKit arbitrary-code-execution flaws reachable via malicious web content, several sandbox-escape and Gatekeeper-bypass bugs (DesktopServices, LaunchServices, ArchiveService, BOM, System Settings), and remote-code-execution issues in Remote Management and Screen Sharing Server. Additional notable items include unauthorized camera access (CVE-2026-86990), Keychain item exposure to a local attacker (CVE-2026-28864), and a Kerberos KDC impersonation flaw in Heimdal (CVE-2026-112518).

For defenders, this is a routine but large monthly Apple patch cycle: no mass-exploitation or zero-day urgency is reported, but the breadth of kernel, WebKit, and privilege-escalation fixes warrants prompt deployment across managed Apple fleets, particularly for internet-facing Safari/WebKit components and devices still on older OS branches (iOS 18.x) that received the delayed CoreGraphics fix.

## Mentioned in this report

- Vulnerabilities: CVE-2022-26704, CVE-2026-112427, CVE-2026-112428, CVE-2026-112430, CVE-2026-112434, CVE-2026-112438, CVE-2026-112453, CVE-2026-112473, CVE-2026-112484, CVE-2026-112487, CVE-2026-112492, CVE-2026-112493, CVE-2026-112494, CVE-2026-112511, CVE-2026-112518, CVE-2026-112530, CVE-2026-112541, CVE-2026-112543, CVE-2026-112545, CVE-2026-112548, CVE-2026-112556, CVE-2026-112568, CVE-2026-112575, CVE-2026-112612, CVE-2026-112623, CVE-2026-112626, CVE-2026-112637, CVE-2026-112639, CVE-2026-112655, CVE-2026-112659, CVE-2026-112672, CVE-2026-112677, CVE-2026-112688, CVE-2026-112690, CVE-2026-113897, CVE-2026-113900, CVE-2026-113947, CVE-2026-28864, CVE-2026-86950 (KEV), CVE-2026-86990

Source reporting: https://isc.sans.edu/diary/rss/33458

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9d4609dc-884d-5b29-8d4a-5b79e3a831f5/apple-ships-304-fixes-no-new-in-the-wild-bugs.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup