Apple iOS and macOS 27.2: 286 flaws, zero-day fix reaches iOS 18

On Monday 26 October Apple released a new round of security updates for all its operating systems. For anyone managing corporate devices there are two pieces of news: the 27.2 versions of iOS, iPadOS and macOS fix a total of 286 vulnerabilities, and the fix for CVE-2026-86950, the CoreGraphics zero-day already exploited in targeted attacks, now also reaches iPhones and iPads still on iOS 18.

The CoreGraphics zero-day fix reaches iOS 18

At the end of September Apple fixed CVE-2026-86950, an out-of-bounds write in CoreGraphics, with iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. According to the vendor, the flaw may have been exploited in an “extremely sophisticated” attack against specific individuals, on versions of iOS before iOS 27. The technical details are in our September article.

This week’s updates close the gap that was left open:

• iOS and iPadOS 18.7.11 fix three vulnerabilities, including CVE-2026-86950 (as reported by SecurityWeek);
• according to BleepingComputer, the fix now covers iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later;
• according to SecurityWeek, iOS and macOS 27 do not appear to be affected.

There is no new information on the attacks: no public indicators of compromise, no attributed actor, no details on how the malicious file was delivered.

Outlets disagree on the count of 2026 zero-days. BleepingComputer counts two exploited this year: CVE-2026-86950 and CVE-2026-20700 in dyld (the dynamic linker of Apple’s systems), fixed in February. In September, The Register spoke of the seventh zero-day of the year instead. BleepingComputer also recalls that earlier this year Apple had already brought to older iPhones and iPads the fixes for four vulnerabilities used with the Coruna exploit kit in espionage and cryptocurrency theft campaigns.

The 286 flaws in version 27.2

The figures, as reported by SecurityWeek:

• macOS Golden Gate 27.2: 263 vulnerabilities;
• iOS and iPadOS 27.2: 163 vulnerabilities, about 140 shared with macOS;
• iOS and iPadOS 26.7.2: 134; macOS Tahoe 26.7.2: 213; macOS Sequoia 15.8.2: 197;
• tvOS 27.2: 72; watchOS 27.2: 62; visionOS 27.2: 125; Safari 27.2: 33.

On iOS and iPadOS 27.2 the largest group concerns memory corruption in WebKit, in the kernel and in the components that process images, fonts, PDFs, audio and video: some of these flaws can lead to arbitrary code execution. There are also flaws that let apps read sensitive data or bypass privacy preferences, WebContent sandbox escapes, a Kerberos KDC impersonation issue and a bug that gives a nearby attacker access to a Thread network.

On macOS Golden Gate 27.2 the highlights are:

• more than a dozen privilege escalation flaws that can give an app root access;
• sandbox escapes and Gatekeeper bypasses;
• kernel memory corruption in file system and disk image components;
• numerous flaws in Screen Sharing, Remote Management and SMB that can be attacked remotely or from the local network, including a Remote Management bug that lets a remote attacker execute arbitrary code.

For none of these vulnerabilities do the sources report ongoing exploitation: the only exploited one remains CVE-2026-86950. In MITRE ATT&CK terms, the flaw classes that matter most for a company are privilege escalation (T1068, Exploitation for Privilege Escalation) and macOS remote services, which an attacker already inside the network can use to move around (T1210, Exploitation of Remote Services).

Impact for European and Italian companies

There are two risks to manage, and they are different:

• older iPhones and iPads, often still in the hands of executives or used as shared devices on wards, in shops or in warehouses: until this week they remained exposed to a zero-day already used in real attacks;
• Macs with Remote Management, Screen Sharing or SMB enabled on the corporate network: remote code execution is the most sensitive case, because it turns an administration service into a lateral movement path.

For NIS2 entities, vulnerability management also covers smartphones, tablets and Macs: updates of this size must be planned and documented like those for Windows and servers. In healthcare, where iPads and iPhones are used to consult clinical data, devices stuck on iOS 18 should be checked first.

What to do now

1. Take inventory: from the MDM console, extract devices running iOS or iPadOS 18 earlier than 18.7.11, 26 earlier than 26.7.2 and 27 earlier than 27.2; for Macs, versions earlier than Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2.
2. Start with iOS 18: these are the devices that until a few days ago had no fix for the zero-day. Enforce 18.7.11 with a short deadline, beginning with the most exposed people.
3. Protect your Macs: update them and, in the meantime, restrict Remote Management, Screen Sharing and SMB sharing to administration hosts only, or turn them off where they are not needed. They must never be reachable from the internet.
4. Don’t forget the rest: Safari 27.2 fixes 33 vulnerabilities; the plan should also include Apple TVs in meeting rooms and corporate Apple Watch and Vision Pro devices.
5. Exclude unsupported devices: models that do not even receive 18.7.11 should be cut off from corporate data or replaced.

How ARXDOME helps

On Macs, the ARX Sentry agent collects the system and software inventory, so it shows which machines do not yet have macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2. ARX Shield lists open vulnerabilities per machine, highlights those already exploited and tracks their trend day by day until they are closed. For iPhones and iPads, the control point remains the MDM console.

Last updated: 27 October 2026