Apple released iOS 26.7 and iPadOS 26.7 yesterday, alongside the public launch of iOS 27. There are no new features in this update. It exists purely to patch security holes for anyone who wants to stay on iOS 26 a little longer before moving to iOS 27.
According to Apple’s security support document, the update closes more than 80 vulnerabilities spread across the Kernel, WebKit, Bluetooth, and dozens of other frameworks. Several of them are serious enough that anyone still running iOS 26 should install this update right away, even if they plan to hold off on iOS 27 for now.
The most severe fix in this release involves the Kernel. Apple patched a permissions issue, tracked as CVE-2026-43689, that could let a malicious app gain root privileges on the device. Root access is the highest level of control on iOS, so this one matters even without a confirmed real-world exploit.
The Kernel section of the update is also the largest by far, with well over a dozen separate fixes covering use-after-free bugs, race conditions, out-of-bounds reads and writes, and memory corruption issues. Most of these require a malicious app already running on the device, but several could lead to kernel memory disclosure or full system crashes.
CVE-2026-65414 addressed an out-of-bounds write in Bluetooth that Apple says could let a remote attacker cause unexpected app termination or execute arbitrary code. Apple’s notes don’t specify what conditions are needed to trigger it, which is worth keeping in mind for anyone who leaves Bluetooth on by default.
Several fixes target how iOS handles untrusted content. WebKit had a use-after-free issue (CVE-2026-43715) that could lead to memory corruption from maliciously crafted web content. A separate WebKit Canvas bug (CVE-2026-64718) could crash Safari outright.
Video and image processing frameworks took a heavy share of patches too. ImageIO alone accounts for five separate CVEs this release, ranging from process memory disclosure to memory corruption from a single crafted image file. CoreMedia and CoreMedia Video Toolbox also received fixes for bugs triggered by maliciously crafted video files.
CVE-2026-84598 patched a path traversal issue in MobileBackup that could let an attacker with physical access to a trust-paired device read and write arbitrary files. Separately, CVE-2026-86890 fixed a Siri Suggestions bug that could expose sensitive information to an attacker with physical access to a locked device.
Apple Credited Anthropic’s Claude in Three Vulnerability Discoveries
The credits section has one detail worth flagging. Apple lists “Claude and Anthropic Research” as a contributor on three separate CVEs in this release: an AVEVideoEncoder crash bug (CVE-2026-65410), a Foundation denial-of-service issue (CVE-2026-65409), and the WebKit use-after-free bug (CVE-2026-43715) alongside researchers Milad Nasr and Nicholas Carlini.
Apple’s security acknowledgments have always credited external researchers by name. This is the first time an AI system has been credited alongside them in one of these documents, and it suggests AI-assisted fuzzing and code analysis are now a real part of how vulnerabilities get found in Apple’s codebase.
iOS 26.7 Runs on the Same Devices as iOS 26
iOS 26.7 and iPadOS 26.7 apply to the same device list Apple has used for iOS 26 all year:
- iPhone 11 and later
- iPad Pro 12.9-inch, 3rd generation and later
- iPad Pro 11-inch, 1st generation and later
- iPad Air, 3rd generation and later
- iPad, 8th generation and later
- iPad mini, 5th generation and later.
