iOS 27.2 security update: what it fixes and should you install it

iPhoneUpdated

Apple released iOS 27.2 on 26 October 2026 for iPhone 11 and later, and its security notes list 163 CVE entries fixed in it. On the same day Apple released iOS 26.7.2, also for iPhone 11 and later, and iOS 18.7.11 for the iPhone XS, XS Max and XR. Apple says it is aware of a report that one flaw fixed in iOS 18.7.11 may have been exploited.

Quick answer

iOS 27.2 came out on 26 October 2026 and fixes security flaws in WebKit and many other parts of iOS. Apple doesn't say any iOS 27.2 flaw was exploited. To install it, go to Settings > General > Software Update and tap Download and Install. If you have an iPhone XS, XS Max or XR, install iOS 18.7.11.

What does iOS 27.2 fix?

Apple's page "About the security content of iOS 27.2 and iPadOS 27.2" says the update was "Released October 26, 2026" and is available for iPhone 11 and later. By our count it lists 163 CVE entries. Three examples, in Apple's words:

  • WebKit (CVE-2026-112697): "Processing maliciously crafted web content may lead to arbitrary code execution".
  • WebKit Process Model (CVE-2026-113897): "A remote attacker may be able to break out of Web Content sandbox".
  • AccessorySetupKit (CVE-2026-84493): "A malicious app may be able to access Bluetooth without user consent".

One entry is about physical access. Under Accounts, Apple lists: "An attacker with physical access to a trust-paired device may be able to read and write arbitrary files".

Apple's notes for iOS 27.2 contain no statement that any of these flaws has been exploited. For what CVE numbers mean, see what is a CVE?

Which iPhones get iOS 27.2, 26.7.2 or 18.7.11?

Apple's security releases page lists three iPhone updates on 26 October 2026:

  • iOS 27.2: iPhone 11 and later.
  • iOS 26.7.2: iPhone 11 and later. Its security notes list 134 CVE entries, and contain no statement that any was exploited.
  • iOS 18.7.11: iPhone XS, iPhone XS Max, iPhone XR (and iPad 7th generation).

The same page lists iOS 27.1 for iPhone Duo on 23 October 2026, and says "This update has no published CVE entries." If you have an iPhone Duo, Settings > General > Software Update shows what's available for it. Our guide to iPhone Duo security features covers the rest.

Was anything exploited?

For iOS 18.7.11, Apple says one flaw may have been. Its notes list a CoreGraphics flaw, CVE-2026-86950, where "Processing a maliciously crafted file may lead to arbitrary code execution." Apple adds: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."

That entry appears in the iOS 18.7.11 notes, which are for the iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation. Apple doesn't list it in the iOS 27.2 or iOS 26.7.2 notes. If you own an iPhone XS, XS Max or XR, iOS 18.7.11 is the update to install.

Should you install iOS 27.2?

Apple's security releases page says "Keeping your software up to date is one of the most important things you can do to maintain your Apple product's security." Our guide to a free security app for iPhone covers what else iOS does to protect you.

Two things to know first, from Apple:

  • Back up your iPhone with iCloud or your computer before you update.
  • "after a software update is installed for iOS, iPadOS, tvOS, watchOS, and visionOS, it cannot be downgraded to the previous version."

How do I update my iPhone?

Apple's steps:

  1. Back up your device using iCloud or your computer.
  2. Plug it into power and connect to the internet with Wi-Fi.
  3. Open Settings, tap General, then tap Software Update. Your current version of iOS is shown, and whether an update is available.
  4. If an update is available, tap Download and Install, then follow the onscreen instructions.

To stay current, go to Settings > General > Software Update > Automatic Updates and turn on Automatically Install. Apple says your iPhone then downloads and installs updates overnight while charging and connected to Wi-Fi, and you're notified before it installs.

If the update doesn't appear, Apple says you can update using a computer instead. It also notes that VPN or proxy connections may stop your iPhone reaching the update servers.

What if I get an email or pop-up about an iPhone security update?

Apple's update steps start in Settings > General > Software Update, or on a computer. If an email, text or web page says your iPhone needs an urgent security update and gives you a link, check Software Update yourself instead. Our guide to security update scam emails covers how to spot and report them, and how to check if your iPhone is hacked goes through Apple's own checks.

More questions

When was iOS 27.2 released?

Apple's security notes say iOS 27.2 and iPadOS 27.2 were released on 26 October 2026. iOS 26.7.2 and iOS 18.7.11 came out the same day.

How many security fixes are in iOS 27.2?

By our count, Apple's iOS 27.2 security notes list 163 CVE entries. The iOS 26.7.2 notes list 134, and the iOS 18.7.11 notes list 3.

Was iOS 27.2 released because of an exploited flaw?

Apple's iOS 27.2 notes contain no statement that any of its flaws was exploited. The flaw Apple says may have been exploited, CVE-2026-86950, is in the iOS 18.7.11 notes, and Apple's report concerns versions of iOS before iOS 27.

I'm on iOS 26. Do I have to move to iOS 27?

Apple released iOS 26.7.2 for iPhone 11 and later on 26 October 2026, alongside iOS 27.2. Software Update shows which versions your iPhone is offered.

Can I go back to an earlier version after updating?

No. Apple's security releases page says that after a software update is installed for iOS, it cannot be downgraded to the previous version.

Sources