Patch Gap

Mac · updated Oct 27, 2026

Mac, iPhone and iPad: two bugs fixed in November 2025 were later found in real attacks

Patched: update nowBeing attacked nowHigh

Last checked · Check before installing; only use the official link.

Two bugs in the core of Apple's systems let a bad app take more control of a Mac, iPhone or iPad. Apple fixed them in November 2025. In March 2026 the US government said attackers were using them.

Status
Patched: update now
Being attacked?
Yes[5]
Severity
High
Updated

CISA added both to its list of bugs used in real attacks on Mar 20, 2026. Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .

Am I affected?

You are at risk if your Mac runs macOS Tahoe older than 26.1, Sequoia older than 15.7.2 or Sonoma older than 14.8.2, or your iPhone runs iOS 26 older than 26.1.

AppDeviceAffectedFixed in
macOSMacmacOS Tahoe before 26.1, Sequoia before 15.7.2, Sonoma before 14.8.226.1 (Tahoe) / 15.7.2 (Sequoia) / 14.8.2 (Sonoma)[1][2][3]
iPhone and iPad (iOS)iPhone / iPadiOS and iPadOS 26 before 26.1iOS 26.1[4]

How to check your version

These checks only look. They do not change anything on your computer.

macOS on Mac

Easy way: Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.

Or type this in TerminalRead-only. It only reads the version and changes nothing.

sw_vers -productVersion

iPhone and iPad (iOS) on iPhone / iPad

Easy way: On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.

How to fix it

  1. Click the Apple menu > System Settings > General > Software Update.
  2. Install the update it offers.
  3. Restart your Mac when asked.
  4. On iPhone or iPad: Settings > General > Software Update.

More on each app: Is my Mac up to date?, Is my iPhone up to date?

Official links

Check before installing, and only use these official links or the app's own update button.

For AI agents

This page as data: /incidents/apple-attacked-bugs-nov-2025.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.

Tracking numbers (CVE): CVE-2025-43510, CVE-2025-43520

Sources

  1. MakerApple: About the security content of macOS Tahoe 26.1 (Nov 3, 2025)
  2. MakerApple: About the security content of macOS Sequoia 15.7.2 (Nov 3, 2025)
  3. MakerApple: About the security content of macOS Sonoma 14.8.2 (Nov 3, 2025)
  4. MakerApple: About the security content of iOS 26.1 and iPadOS 26.1 (Nov 3, 2025)
  5. CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-43510, CVE-2025-43520 (added 2026-03-20) (Mar 20, 2026)

"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.