Apple patches 140+ iOS/iPadOS vulnerabilities
NCSC-NL flags an Apple security update fixing over 140 iOS/iPadOS vulnerabilities, including a critical CVE-2026-65414 (CVSS 9.8); no in-the-wild exploitation reported.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The Dutch National Cyber Security Centre (NCSC-NL) published an advisory summarizing Apple's latest security update for iOS and iPadOS, which addresses a very large batch of vulnerabilities (well over 140 CVEs) spanning path traversal, cross-site scripting, stack-based buffer overflow, out-of-bounds read/write, race conditions, use-after-free, improper resource shutdown, external control of critical state data, and missing authorization issues. These flaws sit across core OS components including file handling, memory management, authentication processes, and web content rendering.
According to the advisory, successful exploitation could let an attacker gain unauthorized access to user data, cause application or system crashes, read or corrupt kernel memory, escalate privileges, bypass sandbox restrictions, or manipulate network traffic. Some issues could expose sensitive information such as Wi-Fi passwords, device identifiers, and user location data. The most severe entry, CVE-2026-65414, carries a CVSS v3 score of 9.8, with several others (CVE-2026-43686, CVE-2026-43715, CVE-2026-65415) rated 8.1–8.8. NCSC-NL does not indicate any of these vulnerabilities are being actively exploited in the wild; this is a routine, if unusually large, vendor patch release. Apple has issued fixes via improved validation, stricter access controls, better memory/state management, and removal of vulnerable code paths. Defenders should prioritize deployment of the latest iOS/iPadOS updates across managed fleets, particularly for the highest-CVSS entries, and track for any subsequent in-the-wild exploitation reporting.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0370.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs