Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026. Apple’s security advisory describes fixes for flaws that could expose sensitive data, bypass privacy preferences or allow malicious web content to run code. A reported total of 163 CVE identifiers covers the combined iPhone and iPad advisory, but Apple presents its fixes individually rather than as a headline count.
CVE identifiers are labels for reported security vulnerabilities. Notebookcheck reported the count of 163; it is a tally of identifiers, not a total Apple states in the advisory’s headline.
This is a separate release from the earlier iOS 27 security bulletin covered in NeoTeo’s report on that update.
What the listed flaws could allow
Apple describes potential impacts, not confirmed incidents. For the Apple Intelligence issue, CVE-2026-86987, Apple lists iPhone 15 Pro and later and specified iPad Pro, iPad Air and iPad mini models. The separate file-access flaw, CVE-2026-112612, requires an attacker to have physical access to a trust-paired device.
| CVE and component | Potential impact described by Apple | Apple’s stated fix |
| CVE-2026-86987, Apple Intelligence | A remote attacker may access sensitive user data. | Improved entitlement checks. |
| CVE-2026-112500, Mail and Hide My Email | The original email address associated with Hide My Email may be exposed. | Improved restrictions. |
| CVE-2026-112697, WebKit | Maliciously crafted web content may lead to arbitrary code execution. | Improved memory management. |
| CVE-2026-112612, Accounts | An attacker with physical access to a trust-paired device may read and write arbitrary files. | Improved path validation. |
| CVE-2026-113898, Accounts | An app may bypass Privacy preferences. | Improved data redaction. |
| CVE-2026-84493, AccessorySetupKit | A malicious app may access Bluetooth without user consent. | Improved state management. |
Apple also describes a separate Accounts flaw, CVE-2026-112446, that could let an app access sensitive user data; the fix adds entitlement checks. These entries address different issues and conditions, rather than describing one universal attack path. For an affected device, installing the relevant security update is a prudent precaution.
What Apple says about exploitation
Apple’s advisory does not say whether any listed vulnerability was actively exploited. Its descriptions identify possible impacts and the fixes; they do not establish that a particular user’s data was accessed.
How Apple evaluates vulnerability reports
Apple’s Security Research guidelines require an actionable technical explanation, reproducible steps and a working exploit or reliable proof of concept. Apple also says findings discovered by AI without proper validation are not eligible for bounty rewards. Those rules describe Apple’s reporting program; they do not identify how any particular iOS 27.2 vulnerability was discovered. Read Apple’s vulnerability reporting guidelines.
