Apple released iOS 26.6.1 and iPadOS 26.6.1 on August 17, a security update that fixes 29 issues across iPhone 11 and later and most current iPad models. The most serious is a Telephony bug that let an attacker in a privileged network position bypass IPSec authentication and intercept traffic, alongside an ImageIO flaw where processing a malicious image could lead to arbitrary code execution. Apple says none of the 29 issues are known to have been exploited before the fix shipped, so this is a patch-now situation rather than an active-attack one.
What’s actually in iOS 26.6.1
Per Apple’s own security content page for the release, the update touches several components. The IPSec authentication bypass, tracked as CVE-2026-65329, was reported by researchers at Ruhr University Bochum and fixed with what Apple describes as improved state management. The image-processing RCE, CVE-2026-65346, came from an integer overflow in ImageIO and could let a maliciously crafted image run code just by being processed, no interaction beyond that required.
The bulk of the count, 21 of the 29 CVEs, are WebKit bugs that could cause memory corruption or a Safari crash if a device loads a malicious web page. There are also several kernel issues that could crash a device or expose kernel memory, and an Audio bug that could let an app leak sensitive user information through a logic flaw in a permission check.
Apple shipped this alongside macOS Tahoe 26.6.2, patching an overlapping set of issues on Mac. It’s the company’s third security release in about three weeks, following the actively exploited macOS Screen Sharing vulnerability patched on August 6.
Who should update, and why the IPSec bug matters more than it sounds
Everyone on a supported device should install this one. There’s no known exploitation yet, but 29 disclosed vulnerabilities on a platform this widely used are a blueprint for attackers now that the technical details are public, and several outlets have already published breakdowns of the more serious bugs.
The IPSec bypass deserves a second look from anyone managing devices on a business network or relying on a VPN for remote work. The bug lets someone already positioned on the network intercept traffic that’s supposed to be authenticated and encrypted, which defeats a good part of the reason to run IPSec at all. If your team issues iPhones or iPads for field work and connects them back to internal systems over VPN, this is worth pushing out through MDM today.
If your business ships its own iOS app, it’s also a good moment to confirm you’re testing against 26.6.1 before it reaches most of your users, rather than finding out about a compatibility issue from support tickets. That kind of ongoing testing and maintenance is part of what we handle under Mobile Application Development for clients who don’t want to track every OS release themselves.
Update by going to Settings, then General, then Software Update. It applies the same way it always has.
