Apple shipped four security updates on August 17, 2026, fixing 122 vulnerabilities in iOS 18.7.10 and iPadOS 18.7.10, 29 in iOS 26.6.1 and iPadOS 26.6.1, and 28 in macOS Tahoe 26.6.2. None of the flaws in this batch are known to have been exploited — but a separate macOS bug Apple patched eleven days earlier is being used right now to plant cryptominers on internet-facing Macs.
The standout new issue is CVE-2026-65329, a Telephony flaw that only affects iPhone 11 and later. Apple describes it as an authentication issue that lets an attacker in a privileged network position bypass IPSec authentication and intercept network traffic, and credits Bedran Karakoc, Tobias Funke, Jacopo Clark and Katharina Kohls of Ruhr University Bochum. It is the single vulnerability that separates iOS 26.6.1 from macOS Tahoe 26.6.2 — the other 28 fixes are identical across both.
What Apple Released on August 17, 2026
Apple published three security advisories and shipped a fourth update with no advisory attached. As of August 18, 2026, visionOS 26.6.1 is listed on Apple's security releases page with the note that details are coming soon.
| Update | Devices covered | CVEs fixed |
|---|---|---|
| iOS 26.6.1 and iPadOS 26.6.1 | iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, iPad mini 5th generation and later | 29 |
| iOS 18.7.10 and iPadOS 18.7.10 | iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation | 122 |
| macOS Tahoe 26.6.2 | macOS Tahoe | 28 |
| visionOS 26.6.1 | Apple Vision Pro | Not yet published |
There is no watchOS, tvOS, Safari or Xcode update in this round. macOS Sequoia and macOS Sonoma also sat this one out — those branches last received fixes on August 6, 2026, in macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Are Any of These Vulnerabilities Being Exploited?
No. Apple's advisories for iOS 26.6.1, iOS 18.7.10 and macOS Tahoe 26.6.2 contain none of the language Apple normally uses when a flaw has been attacked in the wild, and no CVE in the August 17 batch carries an exploitation note. There are no zero-days here.
That is not the same as saying Apple users are safe this week. A macOS flaw Apple patched on August 6, 2026 — CVE-2026-65400 in Screen Sharing — is under active exploitation, and it is the bug Mac administrators should be chasing today.
CVE-2026-65400: The Screen Sharing Flaw That Is Actually Being Attacked
CVE-2026-65400 is an authentication bypass in screensharingd, the daemon behind macOS Screen Sharing, which exposes remote desktop access over the VNC protocol on TCP port 5900. Apple fixed it on August 6, 2026, in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9, crediting Alfredo Pesoli (@__rev) via Bynario Atlas.
The Netherlands' National Cyber Security Centre (NCSC-NL) updated its advisory NCSC-2026-0280 on August 12, 2026, to report active exploitation. According to NCSC-NL, attackers hit multiple systems with port 5900 reachable from the internet, and in every confirmed case, "root had been accessed on the affected system" before a Monero cryptocurrency miner was installed.
Because the bypass happens before authentication, the hardening steps most Mac administrators would reach for do not help. Removing approved Screen Sharing users, disabling legacy VNC password access and rotating the VNC password all sit downstream of the check the flaw defeats. Security firm Calif, which analysed the bug, noted that the attack needs only a valid account name, and that "a username is not a secret" on macOS.
How the assessment of CVE-2026-65400 changed over 12 days
The public record on this vulnerability moved faster than most tracking systems did, and the sources still disagree. Cyber Kendra assembled the following timeline from Apple's advisory, the NVD change log and NCSC-NL's advisory.
| Date | Source | Assessment |
|---|---|---|
| 6 Aug 2026 | Apple advisory HT148170 | Patch shipped, no exploitation noted |
| 7 Aug 2026 | NVD (CISA-ADP) | CVSS 3.1 scored 7.1 High, CWE-287, impact partial |
| 7 Aug 2026 | NCSC-NL advisory NCSC-2026-0280 | Advisory published, no exploitation reported |
| 12 Aug 2026 | NCSC-NL advisory update | Active exploitation observed, root access and Monero miner |
| 14 Aug 2026 | NVD (CISA-ADP) | CVSS 3.1 raised to 9.8 Critical, attack rated automatable |
| 15 Aug 2026 | CISA SSVC record | The exploitation decision point is still recorded as "none" |
| 18 Aug 2026 | CISA KEV catalog | Not listed at time of writing |
The gap matters operationally. A team that filters patch priority on CISA KEV membership alone would not have flagged CVE-2026-65400 as of August 18, 2026, even though a European national CERT has documented root compromise in the wild and the CVSS vector was rewritten to reflect no privileges required and full compromise of confidentiality, integrity and availability.
Cyber Kendra has not independently verified the exploitation reports and is relying on NCSC-NL's published advisory.
If you cannot patch immediately, disable Screen Sharing in System Settings under General, then Sharing, and block TCP port 5900 at the network edge. CVE-2026-65400 is also distinct from CVE-2026-43760, a separate Screen Sharing issue that requires the attacker to already know a configured VNC password.
What iOS 26.6.1 and macOS Tahoe 26.6.2 Actually Fix
iOS 26.6.1 and macOS Tahoe 26.6.2 patch the same 28 vulnerabilities, with the iPhone-only Telephony flaw making up iOS's 29th. Both updates are unusually browser-heavy: 21 of the 29 CVEs in iOS 26.6.1 sit in WebKit, WebKit History or WebKit Storage.
The fixes worth knowing about outside WebKit:
- CVE-2026-65346 (ImageIO) — an integer overflow where processing an image may lead to arbitrary code execution. Credited to Meta Red Team X's Nik Tsytsarkin.
- CVE-2026-65339 (Audio) — a logic issue that could let an app leak sensitive user information. Also credited to Meta Red Team X.
- CVE-2026-65343 (Kernel) — a use-after-free that a remote attacker could use to cause unexpected system termination.
- CVE-2026-65330 and CVE-2026-65349 (Kernel) — memory corruption and out-of-bounds read issues reachable from an app.
- CVE-2026-64788 (IOGPUFamily) — memory corruption triggered by maliciously crafted web content, which pairs a browser entry point with a graphics driver bug.
- CVE-2026-65347 (ImageIO) — a denial-of-service when processing an image.
Apple does not publish CVSS scores in its advisories, so severity ratings for these CVEs will only appear once NVD analysts enrich them.
Why iOS 18.7.10 Fixes 122 Bugs When iOS 26.6.1 Fixes Only 29
The 122 figure is the headline number this round, and it is widely misread. iOS 18.7.10 is not a bigger or more urgent update than iOS 26.6.1 — it is a backport that closes a two-release backlog for legacy hardware in one go.
Apple states in the advisory that iOS 18.7.10 delivers fixes first made available in the iOS 26.6 and 27 betas. iOS 26.6 shipped to modern devices on July 27, 2026, and iOS 26.6.1 shipped on August 17. Devices still on the iOS 18 branch missed both, so Apple rolled roughly six weeks of accumulated fixes into a single release.
iOS 18.7.10 also covers a much smaller device set than earlier iOS 18.7.x releases did: only iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad. As recently as iOS 18.7.8 in April 2026, that branch still served iPhones through the iPhone 16 range.
Here is where the 122 CVEs land by component:
| Component | CVEs in iOS 18.7.10 |
|---|---|
| WebKit (including Canvas, History, Process Model, Storage) | 42 |
| Kernel | 18 |
| Model I/O | 9 |
| ImageIO | 5 |
| SceneKit | 4 |
| WebRTC | 3 |
| CoreAudio | 3 |
| Contacts | 3 |
| All other components | 35 |
Forty-five of the 122 CVEs — WebKit plus WebRTC — are browser-engine bugs. That is the reachable-from-a-web-page attack surface, and it is why an old iPhone left unpatched is a meaningfully worse place to browse the web than a current one.
AI Tooling Now Accounts for a Third of Apple's WebKit Credits
The most durable story in this release is not a single CVE. It is who found the bugs. Nine of the 29 CVEs in iOS 26.6.1 are credited to OpenAI Codex Security, all to researcher Amy Burnett, and the same nine appear in macOS Tahoe 26.6.2.
Widen the view to iOS 18.7.10, which carries the full two-release backlog, and the pattern becomes clearer. Cyber Kendra counted the AI-lab and AI-tooling credits across all 122 entries:
| Credited to | CVEs in iOS 18.7.10 | Example |
|---|---|---|
| OpenAI Codex Security — Amy Burnett | 10 | CVE-2026-65331 |
| Milad Nasr and Nicholas Carlini with Claude, Anthropic | 1 | CVE-2026-64757 |
| Trail of Bits via Anthropic CVD | 1 | CVE-2026-28984 |
| Z.AI GLM | 1 | CVE-2026-43663 |
| NVIDIA AI Red Team — Aaron Grattafiori | 1 | CVE-2026-43701 |
That is 14 CVEs, all of them in the WebKit family, out of 45 browser-engine bugs in the release — roughly 31 percent. Some of those credits are shared with human researchers, so the correct reading is that AI-assisted review contributed to about a third of Apple's browser-engine findings this cycle, not that it found them alone.
We would treat this as the leading indicator to watch across Apple's next few releases. WebKit is a large, fuzzable, memory-unsafe C++ codebase with a clear crash oracle, which makes it close to a best case for automated bug discovery. If the share holds or grows in iOS 27, the volume of WebKit CVEs per release is likely to keep climbing — and a rising CVE count will say more about detection capacity than about code quality getting worse.
Apple Confirms macOS 27 Is Called Golden Gate
Apple's own advisory text for macOS Tahoe 26.6.2 says the update delivers "security fixes that were first made available in the macOS Golden Gate 27 beta". The iOS 26.6.1 advisory makes the matching reference to the iOS 27 and iPadOS 27 betas.
That is Apple naming its next macOS release in a support document rather than at an event. Following Sequoia, Sonoma and Tahoe, Golden Gate continues Apple's California landmark naming convention. Apple has not published a release date for macOS 27 or iOS 27.
Which Update Should You Install?
Your device will only offer the one build that applies to it. There is no choice to make and no reason to delay.
- iPhone 11 or newer — install iOS 26.6.1.
- iPhone XS, XS Max or XR — install iOS 18.7.10. These devices cannot run iOS 26.
- iPad 7th generation — install iPadOS 18.7.10. All newer iPads get iPadOS 26.6.1.
- Mac on macOS Tahoe — install macOS Tahoe 26.6.2.
- Mac on macOS Sequoia or Sonoma — you are on 15.7.9 or 14.8.9 from August 6. Confirm you took that update, because it carries the CVE-2026-65400 Screen Sharing fix.
- Apple Vision Pro — install visionOS 26.6.1.
How to install
- On iPhone or iPad, open Settings, tap General, then Software Update.
- On Mac, open System Settings, click General, then Software Update.
- On Apple Vision Pro, open Settings, tap General, then Software Update.
- Turn on Automatic Updates on the same screen so future security fixes install without you checking.
Note that iOS, iPadOS, tvOS, watchOS and visionOS cannot be downgraded once a software update is installed.
Frequently Asked Questions
Is there a zero-day in the August 17, 2026 Apple updates?
No. Apple's advisories for iOS 26.6.1, iOS 18.7.10 and macOS Tahoe 26.6.2 do not mark any CVE as exploited in the wild, and none of the 122, 29 or 28 fixes carries an exploitation note.
What is CVE-2026-65400 and am I affected?
CVE-2026-65400 is an authentication bypass in macOS Screen Sharing that lets a network attacker connect without valid credentials. You are affected if you run macOS Sonoma before 14.8.9, macOS Sequoia before 15.7.9 or macOS Tahoe before 26.6.1 with Screen Sharing enabled. NCSC-NL reported active exploitation against Macs exposing TCP port 5900 to the internet.
Why does iOS 18.7.10 fix 122 vulnerabilities?
iOS 18.7.10 backports fixes that Apple first shipped in the iOS 26.6 and 27 betas. Devices on the iOS 18 branch missed both the July 27 and August 17 releases, so Apple bundled roughly six weeks of accumulated fixes into one update.
Do I need to update if I never use Screen Sharing?
Yes. Screen Sharing is only one of the issues fixed this month, and the August 17 updates patch kernel, ImageIO, Audio and WebKit flaws that are reachable without it. Disabling Screen Sharing is a stopgap for unpatched Macs, not a substitute for updating.
Which Apple devices are no longer getting security updates?
Apple still ships fixes to the iOS 18, iOS 16 and iOS 15 branches for older hardware, though coverage narrows with each release. iOS 18.7.10 now covers only iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad.
What does visionOS 26.6.1 fix?
Apple has not published the security content for visionOS 26.6.1. As of August 18, 2026 the release is listed on Apple's security releases page with details marked as coming soon.