On May 11, 2026, Apple released iOS 26.5 and iPadOS 26.5 to the general public[1]. The accompanying security release page lists more than 60 CVE-IDs, spread across a wide surface that includes Kernel, WebKit, mDNSResponder, and ImageIO[1]. According to press coverage, none of the patched issues are known to have been exploited in the wild[2][3].

Ship date, supported devices, and the scope of the fixes

Apple's security release HT127110 places the release date for iOS 26.5 / iPadOS 26.5 on May 11, 2026[1]. The supported devices span the entire currently supported lineup: iPhone 11 and later, iPad Pro 12.9-inch (3rd generation) and later, iPad Pro 11-inch (1st generation) and later, iPad Air (3rd generation) and later, iPad (8th generation) and later, and iPad mini (5th generation) and later[1].

By CVE-ID count, the update addresses more than 60 issues, with Kernel accounting for six and WebKit for nineteen — by far the largest share[1]. MacRumors and 9to5Mac both characterize the release as patching "more than 50" flaws, and both note that no actively exploited bugs are among the fixes[2][3].

Kernel and WebKit — privilege escalation, memory corruption, and CSP bypass in one batch

In the Kernel area, the more serious patches include CVE-2026-28951 (an authorization state issue that could let an app gain root privileges), CVE-2026-28972 (an out-of-bounds write that could allow kernel memory writes), and CVE-2026-28897 (a buffer overflow that could lead a local attacker to unexpected system termination or kernel memory reads)[1]. On the information-disclosure side, CVE-2026-43654 and CVE-2026-28987 close paths that leaked kernel state[1].

WebKit accounts for nineteen CVEs that affect Safari and any embedded browser surface on iOS[1]. The list ranges from Content Security Policy bypasses (CVE-2026-43660 and CVE-2026-28907), to use-after-free issues that caused Safari to crash (CVE-2026-28883 and CVE-2026-28947 among others), to CVE-2026-28971, in which a malicious iframe could reuse another site's download settings[1]. For one of the Safari crash fixes, CVE-2026-28942, Apple explicitly credits Anthropic researchers Milad Nasr and Nicholas Carlini for work "with Claude"[1].

iPhone Mirroring exposure, a Wi-Fi DoS, and RCS end-to-end encryption arrive together

Among the device-specific fixes, CVE-2026-28963 — under which an attacker with physical access could pull sensitive user data through Visual Intelligence during iPhone Mirroring — applies only to iPhone 15 and later[1]. On the Wi-Fi stack, CVE-2026-28994 closes a use-after-free that allowed an attacker in a privileged network position to trigger denial of service with crafted Wi-Fi packets[1]. mDNSResponder receives four fixes covering DoS and use-after-free conditions, and IOHIDFamily gets two, including app termination and kernel memory layout disclosure[1].

Beyond security, iOS 26.5 introduces end-to-end encryption for RCS messages exchanged between iPhone and Android users[4]. The update also rolls in Maps refinements and a new "Pride Luminance" wallpaper that pairs with the matching Apple Watch face and band[4].

Summary

iOS 26.5 and iPadOS 26.5 are a routine release with no known in-the-wild exploits, but the more than 60 CVEs collected under HT127110 include heavy items such as a Kernel root-privilege escalation and several WebKit memory-corruption issues. Because the update reaches every currently supported iPhone and iPad, eligible users have a clear reason to install it sooner rather than later.

Source:[1] https://support.apple.com/ja-jp/127110

Source:[2] https://www.macrumors.com/2026/05/11/ios-26-5-security-fixes/

Source:[3] https://9to5mac.com/2026/05/11/ios-26-5-has-fixes-for-50-security-issues-on-iphone-details-here/

Source:[4] https://www.macrumors.com/2026/05/11/apple-releases-ios-26-5/