Apple Fixes 163 iPhone, iPad Flaws in iOS 27.2 Update

Apple has released a major security update for iPhones and iPads, addressing vulnerabilities that could expose sensitive information, allow malicious code execution, or undermine critical security protections.

Released Oct. 26, iOS 27.2 and iPadOS 27.2 address weaknesses across WebKit, the operating system kernel, Apple Intelligence, and other components. Security firm Tenable lists 163 CVEs associated with Apple's advisory, including flaws affecting browser security, application permissions, and protected system resources.

The potential consequences make the update important for individual users and organizations managing Apple devices.

Apple fixes WebKit and kernel vulnerabilities

Some of the most concerning vulnerabilities affect WebKit, the browser engine that powers Safari, and the iOS kernel, which manages critical operating system functions.

The WebKit weaknesses include flaws that could allow maliciously crafted web content to trigger memory corruption or unauthorized code execution. These vulnerabilities are concerning because browsers routinely process content from external websites.

Kernel vulnerabilities present a different set of risks. Depending on the flaw, successful exploitation could allow malicious applications to access protected information, interfere with system operations, or compromise security boundaries.

Among the kernel vulnerabilities addressed in the update are:

• CVE-2026-112624: A flaw that could allow an application to bypass privacy preferences.
• CVE-2026-112665: An information disclosure vulnerability that could allow an application to determine the kernel's memory layout.
• CVE-2026-112576: A flaw that could allow an application to make unexpected changes to copy-on-write memory.

Apple addressed these weaknesses through improved validation, memory handling, and security checks.

The vulnerabilities have different exploitation requirements. Apple's advisory does not establish that they can be combined into a working attack chain.

Apple Intelligence and privacy flaws could expose sensitive data

The update also addresses vulnerabilities that could undermine protections for personal information.

One issue, CVE-2026-86987, affects Apple Intelligence and could allow a remote attacker to access sensitive user data. The flaw affects a narrower group of devices than the overall iOS 27.2 update, including the iPhone 15 Pro and later, as well as certain supported iPad models. Apple's advisory identifies the specific affected devices.

Another vulnerability, CVE-2026-112500, affects Apple's Hide My Email feature, which allows users to conceal their personal email addresses when communicating with websites and services. According to Apple, the flaw could expose a user's original email address even when the privacy feature is enabled.

Apple addressed the Apple Intelligence vulnerability through additional entitlement checks and corrected the Hide My Email issue with stronger restrictions.

Other vulnerabilities affect application permissions, certificate validation, and protected system resources.

For example, CVE-2026-112652 could allow a malicious application to bypass certificate validation, potentially weakening a security mechanism that verifies trusted connections.

Other security flaws affect apps, files, and connected devices

Beyond WebKit and the kernel, Apple's security fixes address vulnerabilities across several additional components.

These issues demonstrate the range of potential attack surfaces that the update addresses.

Some vulnerabilities require an attacker to control malicious content, install an application, connect a device, or gain physical proximity to the target. Consequently, the presence of a vulnerability does not mean every affected iPhone can be compromised remotely without user interaction.

Are attackers exploiting the iOS 27.2 vulnerabilities?

Apple has not disclosed known active exploitation of the vulnerabilities patched in iOS 27.2. However, previous iPhone attacks demonstrate why security teams should prioritize installing updates.

In September, Apple patched a CoreGraphics zero-day that the company said may have been exploited in a sophisticated attack against specific individuals.

Earlier in 2026, researchers uncovered the Coruna iOS exploit kit, which contained 23 vulnerabilities across five exploit chains and was linked to attacks compromising thousands of iPhones.

Neither incident has been linked to the vulnerabilities patched in iOS 27.2. They illustrate how attackers can combine software weaknesses to bypass protections and compromise mobile devices.

Which iPhones and iPads are affected?

Apple released iOS 27.2 and iPadOS 27.2 for the following devices:

• iPhones: iPhone 11 and later.
• iPad Pro 12.9-inch: Fourth generation and later.
• iPad Pro 11-inch: Second generation and later.
• iPad Air: Fourth generation and later.
• iPad: Ninth generation and later.
• iPad mini: Sixth generation and later.

Not every vulnerability affects every device in this list. Some components, including Apple Intelligence, are available only on newer hardware.

Apple also released iOS 26.7.2 and iPadOS 26.7.2 for devices remaining on the previous operating system generation.

These updates have separate security advisories, and their vulnerability coverage should not be assumed to be identical to iOS 27.2 and iPadOS 27.2. Users should install the latest available security update for their devices and consult Apple's advisories to determine which vulnerabilities apply.

What iPhone users and security teams should do now

Organizations managing Apple devices should prioritize deployment of the appropriate security updates and confirm that installations have completed successfully.

Recommended actions include:

• Install the latest updates. Navigate to Settings > General > Software Update and install the appropriate release.
• Verify managed devices. Use mobile device management tools to identify devices running outdated operating system versions.
• Prioritize higher-risk users. Review patch status for executives, administrators, and employees handling sensitive information.
• Review application permissions. Limit unnecessary access to sensitive information and device capabilities.
• Enforce device compliance. Where supported, use device management and conditional access policies to restrict corporate access from devices that do not meet security requirements.
• Enable automatic updates. Reduce delays between future security releases and installation.

Organizations should also account for employee-owned devices that access corporate email, applications, or sensitive data.

For security teams managing large device fleets, consistent patch deployment is particularly important. Delayed updates can leave known vulnerabilities exposed across multiple endpoints, increasing an organization's potential attack surface.

For security teams, the priority is straightforward: identify affected devices, deploy the appropriate updates, and verify that installations are complete.

Related reading: For more on emerging iPhone threats, read how DarkSword spyware can steal Apple Keychain credentials and cryptocurrency wallet data from compromised devices.