iOS vulnerabilities and fixes

CVEs that mention iOS, ranked by priority. 78 tracked.

iOS has 78 tracked vulnerabilities, 10 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 72. Most recent: 2026-10-21. Highest priority: CVE-2026-86950 (score 78/100).

• CVE-2026-86950 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Apple Multiple Products Out-of-Bounds Write Vulnerability
• CVE-2026-64695 CRITICAL 9.8 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-20272 CRITICAL 9.8 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-43748 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
• CVE-2026-43757 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-43802 CRITICAL 9.8 UPGRADE An out-of-bounds write issue was addressed with improved bounds checking
• CVE-2026-43809 CRITICAL 9.8 UPGRADE An out-of-bounds read was addressed with improved bounds checking
• CVE-2026-64738 CRITICAL 9.8 UPGRADE A permissions issue was addressed with additional restrictions
• CVE-2026-20263 HIGH 8.6 MITIGATE A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow
• CVE-2026-20268 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20269 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20270 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20271 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20273 HIGH 8.6 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-20267 CRITICAL 9.0 MITIGATE As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software eng
• CVE-2026-0298 HIGH 8.1 UPGRADE An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of
• CVE-2026-17669 CRITICAL 9.6 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17684 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-17967 HIGH 8.8 UPGRADE Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to p
• CVE-2026-20124 HIGH 7.7 MITIGATE A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allo
• CVE-2026-0296 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthentic
• CVE-2026-18534 HIGH 7.4 ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, al
• CVE-2026-0299 HIGH 7.8 UPGRADE UPGRADE Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to
• CVE-2026-28896 HIGH 7.7 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-39877 HIGH 7.8 UPGRADE A memory corruption issue was addressed with improved memory handling
• CVE-2026-0294 HIGH 7.8 UPGRADE A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and ma
• CVE-2026-17703 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17813 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17814 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-17828 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17830 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17835 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17838 MEDIUM 6.5 UPGRADE Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17839 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17873 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17917 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-55777 MEDIUM 5.3 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or thr
• CVE-2025-10290 MEDIUM 6.5 UPGRADE Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not re
• CVE-2026-17789 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-8497 HIGH 7.4 UPGRADE Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager
• CVE-2026-17822 MEDIUM 6.5 UPGRADE Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI
• CVE-2026-17841 MEDIUM 6.5 UPGRADE Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI
• CVE-2026-17842 MEDIUM 6.5 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-20311 MEDIUM 6.3 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, r
• CVE-2026-53986 MEDIUM 5.3 Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcode
• CVE-2026-66061 HIGH 7.1 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-0295 HIGH 7.0 UPGRADE A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-
• CVE-2026-65329 MEDIUM 5.9 UPGRADE UPGRADE An authentication issue was addressed with improved state management
• CVE-2026-17874 MEDIUM 5.4 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17913 MEDIUM 5.4 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-55644 MEDIUM 5.1 Element X iOS is a Matrix iOS Client provided by Element
• CVE-2026-0292 MEDIUM 6.0 UPGRADE An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Win
• CVE-2026-0293 MEDIUM 6.0 UPGRADE A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administra
• CVE-2026-17761 MEDIUM 5.4 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-20308 MEDIUM 4.3 A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, r
• CVE-2026-43738 MEDIUM 5.5 UPGRADE The issue was addressed with improved memory handling
• CVE-2026-43754 MEDIUM 5.5 UPGRADE This issue was addressed with improved redaction of sensitive information
• CVE-2026-64744 MEDIUM 5.5 UPGRADE An information leakage was addressed with additional validation
• CVE-2026-64760 MEDIUM 5.5 UPGRADE UPGRADE An information leakage was addressed with additional validation
• CVE-2026-64723 MEDIUM 5.5 UPGRADE A logic issue was addressed with improved checks
• CVE-2026-17782 MEDIUM 4.3 UPGRADE Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17912 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17941 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17944 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17960 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-17965 MEDIUM 4.3 UPGRADE Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17972 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-18003 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-18013 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-64732 MEDIUM 4.6 UPGRADE UPGRADE This issue was addressed through improved state management
• CVE-2026-17762 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17849 MEDIUM 4.3 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-18016 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a rem
• CVE-2026-43811 MEDIUM 4.7 UPGRADE UPGRADE A race condition was addressed with improved checks
• CVE-2026-0291 MEDIUM 4.4 UPGRADE An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access A
• CVE-2026-17724 MEDIUM 4.2 UPGRADE Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbi
• CVE-2026-17826 LOW 3.1 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-18011 LOW 2.4 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local

FAQ

How do I fix iOS vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is iOS being exploited right now?

Yes: 1 iOS CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which iOS CVE should I patch first?

CVE-2026-86950 currently ranks highest (78/100): Apple Multiple Products Out-of-Bounds Write Vulnerability.

← Back to latest CVEs