watchOS Release History: Security Features From watchOS 7 to 26

Apple shipped six major watchOS releases from watchOS 7 (16 September 2020) to watchOS 26 (15 September 2025), each on the same day as the matching iOS release. Along the way the minimum watch rose from Series 3 to Series 6, Lockdown Mode and device management arrived in watchOS 10, and watchOS 26 added quantum-secure iPhone pairing.

The version number jumped from 11 to 26 because Apple moved every platform to the same number in 2025: iOS 26, iPadOS 26, macOS Tahoe 26, watchOS 26 and tvOS 26 were announced together on 9 June 2025. As of 24 October 2026 the newest release is watchOS 27.0.1, and watchOS 27 runs only on Apple Watch Series 9 and later and Ultra 2 and later, so a Series 6, 7 or 8 now tops out at watchOS 26.

Key takeaways

• watchOS ships on the iOS calendar. Every major release from watchOS 7 to watchOS 27 appeared on Apple's security releases page on the same date as its iOS counterpart, and every watchOS release needs a paired iPhone on the matching iOS major version.
• Hardware cut-offs come in steps. watchOS 9 dropped Series 3, watchOS 11 dropped Series 4, Series 5 and the first SE, and watchOS 27 dropped everything older than Series 9 and Ultra 2 on Apple's update page.
• Old watches stop getting CVE fixes quietly. The last watchOS build with published CVE fixes for a Series 3 was watchOS 8.8.1 (21 June 2023). For Series 4, Series 5 and the first SE it was watchOS 10.6 (29 July 2024). Later builds for those watches exist, but Apple lists them with no published CVE entries.
• Fixes usually land on the watch the same day as on iPhone, but not always. We found same day releases for most actively exploited bugs Apple flagged, and two gaps of three to four weeks (August to September 2022, and March to April 2025).
• Pairing got much stronger. Since watchOS 10, the watch's pairing keys are rooted in its Secure Enclave on first pairing. With watchOS 26 and iOS 26, pairing runs over IKEv2 with ML-KEM-1024 added to elliptic-curve Diffie-Hellman, and ongoing traffic uses ML-KEM-768.
• Health data is locked 10 minutes after the device locks. HealthKit data sits in the Data Protection class "Protected Unless Open", and Health data synced to iCloud is end-to-end encrypted with two-factor authentication and a passcode.
• Selling a watch means unpairing it from the iPhone. Erasing on the watch alone leaves Activation Lock in place.

This post sits next to our iOS release history from iOS 14 to iOS 26, which covers the phone side of each pairing, and our explainer on how a smartwatch is made, which covers sensors, the system on a chip and Bluetooth pairing in general. For the other big mobile platform, see the Android release history from 10 to 16.

One thing to say up front: Safeguard has no Apple Watch app. Nothing in this post installs on a watch, and Safeguard does not manage, scan or update watches. Where Safeguard fits, which is the software teams build around wearables, is covered honestly near the end.

How we sourced the dates and numbers

Every release date in this post comes from Apple's security releases page and its archive pages for 2020 to 2021 and 2022 to 2023. Apple lists each update with the devices it is "available for" and a release date, and links a security content page when CVE entries exist. Updates with nothing to disclose carry the note "This update has no published CVE entries."

Minimum hardware comes from three Apple sources that mostly agree: the "available for" line on each security content page, Apple's "Apple Watch and iPhone compatibility" support article (published 17 September 2026), and the June availability paragraph in each year's Apple Newsroom announcement. Where they disagree, we say so.

CVE counts are distinct CVE IDs on each security content page on 24 October 2026. Apple adds entries after release, so treat them as a snapshot.

How watchOS is released alongside iOS

Apple previews the next watchOS at its developer conference in June, runs developer and public betas over the summer, then ships it in September on the same day as the new iOS. The pattern has held for every release in this history:

• watchOS 7 and iOS 14: 16 September 2020.
• watchOS 8 and iOS 15: 20 September 2021.
• watchOS 9 and iOS 16: 12 September 2022.
• watchOS 10 and iOS 17: 18 September 2023.
• watchOS 11 and iOS 18: 16 September 2024.
• watchOS 26 and iOS 26: 15 September 2025.
• watchOS 27 and iOS 27: 14 September 2026.

The two are coupled for a practical reason. An Apple Watch is set up from, and syncs with, one paired iPhone, and Apple requires the iPhone to be on the matching iOS major version before the watch can move up. Apple's update article states it plainly for the current release: "Updating to watchOS 27 requires iPhone 11 or later, or iPhone SE (2nd generation) or later, with iOS 27." The same article warns that some iOS updates require you to update watchOS too, or Activity and other data may stop syncing.

Point releases follow the same rhythm. In the watchOS 26 cycle, watchOS 26.1 (3 November 2025), 26.2 (12 December 2025), 26.3 (11 February 2026), 26.4 (24 March 2026), 26.5 (11 May 2026) and 26.6 (27 July 2026) each shipped on the same day as the iOS release with the same number. iOS picked up extra security releases in between that had no watchOS twin: iOS 26.0.1 (29 September 2025), 26.4.2 (22 April 2026), 26.5.2 (29 June 2026) and 26.6.1 (17 August 2026). Fixes that were relevant to the watch arrived in the next scheduled watchOS release instead.

Why Apple jumped from watchOS 11 to watchOS 26

On 9 June 2025 Apple announced its Liquid Glass design and named the platforms that would carry it: "iOS 26, iPadOS 26, macOS Tahoe 26, watchOS 26, and tvOS 26." Before that, the numbers had drifted apart; watchOS 11, for example, shipped beside iOS 18. One shared number makes the family easier to read, and in practice it lines up with the year after release: the releases shipped in September 2025 carry 26, and the September 2026 releases carry 27.

So there is no watchOS 12 to 25. A watch that went from watchOS 11.6.1 to watchOS 26 skipped nothing; it moved one major version. The Apple pages we fetched show the new numbers but do not spell out a longer rationale, so we describe the pattern rather than quote a reason.

Timeline table: watchOS 7 to watchOS 27

The table below lists each major release with its date from Apple's security releases page, the oldest supported watch on that release's security content page, the iPhone requirement from Apple's announcements and update article, the headline security and privacy changes we could confirm in Apple's own material, and the number of CVE IDs on the release's security content page.

The "oldest watch" column is what Apple prints on each release's own security content page. The CVE column is not a quality score: it counts what Apple disclosed, and point releases can be larger. watchOS 26.6 listed 106 CVE IDs on 27 July 2026.

Point releases and their dates

The full list matters because it is how you check whether a watch is current. Here is every watchOS 26 release on Apple's security releases page, with the matching iPhone release on the same day where one exists:

After watchOS 27 shipped on 14 September 2026, Apple released iOS 26.7 the same day and iOS 26.7.1 on 28 September 2026 for iPhones staying on iOS 26. As of 24 October 2026 there is no watchOS 26.7 on the security releases page. That matters for owners of a Series 6, 7 or 8, an SE (2nd generation) or the first Ultra: their newest listed release is watchOS 26.6.

Which Apple Watch models dropped off at each version

Apple's compatibility article is the cleanest summary of where each model stops. It lists the range of watchOS versions each model supports:

Two discrepancies are worth knowing about if you manage watches for other people:

1. The compatibility article lags the update article. It still says Series 6, 7 and 8 support "watchOS 7 or later" and so on, without an upper bound, while Apple's "Update your Apple Watch" article says watchOS 27 is compatible with "Apple Watch Series 9 and later" and "Apple Watch Ultra 2 and later." The update article and the watchOS 27 security page (available for "Apple Watch Series 9 and later") agree with each other, so we treat Series 8 and older as capped at watchOS 26. The update article does not mention the SE (3rd generation), and the compatibility article lists it as "watchOS 26 or later." Check Software Update on the watch itself before you assume an SE 3 can or cannot take watchOS 27.
2. "Last version" is not "last update". The compatibility article ends Series 3 at 8.8.1, Series 1 and 2 at 6.3, and Series 4, Series 5 and SE at 10.6.1. Apple's security releases page also lists later builds for those watches: watchOS 6.3.1 (2 February 2026), 8.8.2 (24 March 2026), 10.6.2 (2 February 2026), plus watchOS 5.3.10 (24 March 2026) and 9.6.4 (2 February 2026). Every one of them carries the note "This update has no published CVE entries." Install them anyway, because they are what Apple currently ships for those watches, but do not read them as a return to security support.

Security and privacy features in each version

This section goes release by release. We only list features we could confirm in Apple's own newsroom announcements, Apple Platform Security or Apple Support articles. Many smaller changes ship without being written up in those places, so treat this as the documented spine, not the complete list.

watchOS 7 (September 2020): Series 3 floor and a privacy framing for health features

Apple previewed watchOS 7 on 22 June 2020 with sleep tracking, automatic handwashing detection, new workout types and a hearing health feature, which the announcement says "are designed with privacy in mind." Handwashing detection starts a 20 second timer once it detects washing. Those are health features rather than security controls, but they widened the kind of sensitive data a watch collects, and that is why the Health data protections described later in this post matter.

watchOS 7 ran on Series 3 and later. The Series 1 and Series 2 stayed on the watchOS 6 line, which received watchOS 6.2.9 (5 November 2020) and watchOS 6.3 (14 December 2020) with published fixes, on the same days as watchOS 7.1 and 7.2. That was the last time Apple shipped published CVE fixes for those two models.

The watchOS 7 cycle also contains the first example in this history of a fix landing on the watch the same day as on iPhone for a bug Apple flagged as possibly exploited: watchOS 7.6.2 on 13 September 2021 fixed a CoreGraphics integer overflow in PDF processing (CVE-2021-30860) on the same day as iOS 14.8, with Apple noting it was "aware of a report that this issue may have been actively exploited."

watchOS 8 (September 2021): keys on the wrist and stronger link encryption

Apple's 7 June 2021 preview of watchOS 8 put access first: updates to Wallet and Home "extend Apple Watch as an increasingly useful tool for convenient access across the car and places users live, work, and visit." It described digital home keys, hotel keys and office keys, and digital car keys on Apple Watch Series 6 that can "securely unlock their car from a distance and start it from the driver's seat." Apple's footnotes add that car keys need a participating car manufacturer and that home, office and hotel keys need compatible locks from third parties.

Keys on the wrist raise the stakes of wrist detection. Apple Platform Security explains that with wrist detection on, the watch locks soon after it leaves the wrist, and when it is locked, Apple Pay works only after entering the watch passcode. Turning wrist detection off is done in the Watch app on iPhone, and an organization can enforce the setting through device management.

watchOS 8 is also the floor for the newer link encryption between watch and phone. Apple Platform Security says an iPhone with iOS 15 or later paired with an Apple Watch Series 4 or later on watchOS 8 or later encrypts and integrity protects that link with AES-256-GCM, while older combinations use ChaCha20-Poly1305 with 256-bit keys.

The watchOS 8 line lasted longer than any other in this history because the Series 3 stayed on it. watchOS 8.8.1 on 21 June 2023 fixed a kernel integer overflow (CVE-2023-32434) that Apple said "may have been actively exploited against versions of iOS released before iOS 15.7," on the same day as iOS 15.7.7. It was the last watchOS release with published CVE entries for the Series 3.

watchOS 9 (September 2022): Series 3 dropped and medications data

watchOS 9 was announced on 6 June 2022 for "Apple Watch Series 4 or later paired with iPhone 8 or later and iPhone SE (second generation) or later, running iOS 16." The new Medications app let users track medicines, vitamins and supplements, and in the US warned about critical interactions. Apple's privacy paragraph for the release states that when the iPhone is locked with a passcode, Touch ID or Face ID, all Health app data other than Medical ID is encrypted, and Health data backed up to iCloud is encrypted in transit and on Apple's servers.

Family Setup, which lets a watch be paired to a parent's iPhone for a child who has no iPhone, gained Home app support, and children could use home and hotel keys in Wallet.

watchOS 9 is also the clearest example of a gap between iPhone and watch fixes. On 17 August 2022, iOS 15.6.1 fixed a kernel bug (CVE-2022-32894) and a WebKit bug (CVE-2022-32893), both flagged by Apple as possibly actively exploited. The watchOS update the same day, watchOS 8.7.1, was listed for Series 3 only and has no published CVE entries. Both fixes reached Apple Watch in watchOS 9 on 12 September 2022, 26 days later.

watchOS 10 (September 2023): Lockdown Mode, device management and Secure Enclave pairing keys

watchOS 10 was the biggest security release of the set, even though its announcement led with redesigned apps and the Smart Stack. Four things changed:

• Lockdown Mode. Apple's "About Lockdown Mode" article says Lockdown Mode is available in "watchOS 10 or later," and that when you turn it on for your iPhone, "it's automatically turned on for your paired Apple Watch." Incoming calls will not ring on the paired watch while it is on. Apple Platform Security describes Lockdown Mode as "an optional, extreme protection" for the very few people who might be targeted by mercenary spyware.
• Device management. The 5 June 2023 announcement says watchOS 10 "introduces support for Mobile Device Management (MDM)," letting enterprises install apps and configure accounts on fleets, with "passcode enforcement, and configuring Wi-Fi and VPN settings."
• Pairing keys in the Secure Enclave. Apple Platform Security says that "when an Apple Watch with watchOS 10 or later is first paired, the private keys are rooted in its Secure Enclave." The matching keys on an iPhone with iOS 17 or later are not, because restoring an iCloud Backup to the same iPhone keeps the watch pairing without a migration.
• NameDrop. Contact sharing by bringing the watch close to someone else's iPhone or Apple Watch: a convenience, but also a new way for data to leave the device.

The watchOS 10 cycle includes the best example of coordinated same day fixes. On 21 September 2023, Apple shipped watchOS 10.0.1 for Series 4 and later and watchOS 9.6.3 for Series 4 and later at the same time as iOS 17.0.1 and iOS 16.7, fixing a kernel bug (CVE-2023-41992) and a certificate validation bug (CVE-2023-41991) that Apple said may have been actively exploited against versions of iOS before iOS 16.7. Two weeks earlier, on 7 September 2023, watchOS 9.6.2 fixed a Wallet attachment validation bug (CVE-2023-41061) on the same day as iOS 16.6.1.

watchOS 10.6 (29 July 2024, 32 CVE IDs) was the last release with published CVE entries for Series 4, Series 5 and the first SE.

watchOS 11 (September 2024): Series 6 floor, Check In and Vitals

Apple announced watchOS 11 on 10 June 2024 for "Apple Watch Series 6 or later paired with iPhone Xs or later, running iOS 18." That cut three models at once. The release added the Vitals app, which shows overnight health metrics and alerts when two or more are out of range, and brought Check In to the watch, including during workouts. Check In lets you tell a friend you arrived, or alert them if you did not.

The privacy paragraph in Apple's watchOS 11 announcement is the most explicit statement in this history about Health data in iCloud: "When using iOS, iPadOS, and watchOS with the default two-factor authentication and a passcode, Health app data synced to iCloud is encrypted end-to-end, meaning that Apple does not have the key to decrypt the data and therefore cannot read it."

The watchOS 11 cycle has the second fix-timing gap. watchOS 11.4 (1 April 2025) included a WebKit fix Apple describes as "a supplementary fix for an attack that was blocked in iOS 17.2," noting a report that it "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2." The same supplementary fix had shipped for iPhone in iOS 18.3.2 on 11 March 2025, 21 days earlier. watchOS 11.4 itself was one of the larger point releases of the cycle, with 51 CVE IDs.

watchOS 26 (September 2025): quantum-secure pairing and locked notes

Apple's 9 June 2025 announcement says watchOS 26 is a free update for "Apple Watch Series 6 or later, Apple Watch SE (2nd generation), and all Apple Watch Ultra models, paired with iPhone 11 or later, running iOS 26." The visible changes were the Liquid Glass design, Workout Buddy, which Apple says "analyzes data privately and securely, with Apple Intelligence" and needs an Apple Intelligence-supported iPhone nearby, and the Notes app on the watch, where users "can also pin and unlock notes."

The deeper change is in pairing. Apple Platform Security (published 28 January 2026) says that when an Apple Watch with watchOS 26 or later is paired to an iPhone with iOS 26 or later:

• Pairing exchanges keys over a secure IKEv2 connection, authenticated either with standard pre-shared key authentication using the secret encoded in the animated pattern the watch displays, or with a secret derived from the six-digit PIN using SPAKE2+.
• "ML-KEM-1024 is used to provided quantum security in addition to the security provided by elliptic-curve Diffie-Hellman."
• After pairing, the link between the two devices "utilizes ML-KEM-768 for quantum security in addition to the security provided by elliptic-curve Diffie-Hellman."

ML-KEM is the Module-Lattice-Based Key-Encapsulation Mechanism that NIST standardized as FIPS 203. Using it alongside elliptic-curve Diffie-Hellman is a hybrid design: an attacker who records the pairing today and later gains a quantum computer still has to break both parts.

watchOS 26.2 (12 December 2025) included two WebKit fixes Apple says may have been exploited "against specific targeted individuals on versions of iOS before iOS 26," shipped on the same day as iOS 26.2.

After 26: watchOS 27

watchOS 27 arrived on 14 September 2026 with 102 CVE IDs on its security content page, available for "Apple Watch Series 9 and later." watchOS 27.0.1 followed on 23 September 2026 for Series 12 and Ultra 4, then on 28 September 2026 for Series 9 and later, both with no published CVE entries. Apple's developer documentation already lists release notes for watchOS 27.2 as a release candidate. We have not found a watchOS 27 feature announcement on Apple's newsroom to cite, so this post does not describe watchOS 27 features beyond what the support and security pages say.

Feature by version comparison

The "Yes" in the first three rows reflects the current Apple Platform Security text, which describes these capabilities without tying them to a version. We could not find a dated Apple statement for when each of them first appeared, so read those rows as "present throughout this history" rather than "introduced in watchOS 7."

watchOS and iOS side by side

The asymmetry is visible in the right two columns. iOS 27 still runs on the iPhone 11, a 2019 phone, but watchOS 27 needs a Series 9 from 2023. Apple also keeps older iPhones patched on parallel lines: iOS 18.7.10 (17 August 2026), iOS 16.7.16 and iOS 15.8.8 (both 11 May 2026) all carried published fixes in 2026. We found no equivalent parallel line for older watches carrying published CVE fixes in 2026. If you keep an older watch, you are relying on the newest build Apple lists for it, and you should check that build against the security releases page.

How Apple Platform Security describes watchOS

Apple Platform Security has a short chapter called "System security for watchOS," last published on 28 January 2026. It opens with this: "Apple Watch uses many of the same hardware-based platform security capabilities that iOS and iPadOS use." In practice that means four things.

Secure boot, integrity and updates

The chapter says Apple Watch "performs secure boot and secure software updates," "maintains operating system integrity," and supports the system security technologies listed elsewhere in the guide, naming KIP, SKP and SCIP, which the guide's system security chapters describe in detail (SKP is Sealed Key Protection). watchOS can update overnight, and the guide points to its keybags chapter for how the watch passcode is stored and used during an update.

Apple's security releases page adds one more rule that applies to every watch: "after a software update is installed for iOS, iPadOS, tvOS, watchOS, and visionOS, it cannot be downgraded to the previous version." That is a security property, because it stops someone from rolling a watch back to a build with a known bug.

Data Protection and the Secure Enclave

Apple Watch "implements hardware-encrypted storage and class-based protection of files and keychain items," uses access-controlled keybags for keychain items, and protects the keys used to talk to the iPhone with the same class-based protection. The Secure Enclave is where the pairing private keys live on watchOS 10 and later.

Pairing with one iPhone

A watch pairs with one iPhone at a time. Pairing starts with the animated pattern the watch displays, which the iPhone camera reads, with a six-digit PIN as a fallback. On older software the pattern secret feeds Bluetooth LE 4.1 out-of-band pairing and the PIN feeds Bluetooth Passkey Entry. Keys are then exchanged either through a process adapted from Apple Identity Service or over IKEv2 and IPsec. Apple notes that an iPhone on iOS 13 or later paired with a watch on watchOS 6 or later uses only IKEv2 and IPsec.

After the exchange, the Bluetooth session key is discarded, all traffic between the two devices is encrypted by one of the methods above, and the encrypted Bluetooth, Wi-Fi and cellular links add a second layer. The watch's Bluetooth LE address rotates every 15 minutes to make local tracking harder. When the watch is unpaired, the iPhone tells it to erase all content and settings.

Auto Unlock and approvals

Apple's "Automatically unlock Apple devices" chapter covers three watch relationships: an iPhone unlocking the watch, the watch unlocking a Mac, and the watch unlocking an iPhone when the wearer's nose and mouth are covered. All of them rest on a mutually authenticated Station-to-Station protocol negotiated directly between the Secure Enclaves of both devices.

The mechanics are specific. The device to be unlocked generates a 32-byte unlock secret and sends it to the other device over that tunnel. It then wraps its passcode-derived key with the secret and discards the secret from memory. To unlock, the devices measure their distance over peer-to-peer Wi-Fi, and if they are close enough and policy allows, the secret goes back, the target unlocks, and a fresh secret replaces the old one.

The policy checks are what make it safe:

• Mac unlock with Apple Watch needs the Mac to have been unlocked another way at least once since the watch went on the wrist and was unlocked, the watch to be within 2 to 3 meters, the watch to be unlocked, and the watch not to be in bedtime mode.
• iPhone unlock with Apple Watch also needs the iPhone to have been unlocked in the past 6.5 hours, signs that the wearer is active, sensors detecting a covered nose and mouth, and the iPhone in a state where Face ID is allowed. Tapping "Lock iPhone" in the watch notification locks the phone and disables Face ID and unlock by other devices until the passcode is entered. The watch cannot stand in for Face ID for Apple Pay or app authorizations.
• Apple Watch unlock with iPhone uses a long-term escrow record in the watch keybag so the iPhone can unlock the watch after a restart.

With Auto Unlock enabled, the watch can also approve macOS authorization prompts, third-party app authentication, saved Safari passwords and Secure Notes, in place of or alongside Touch ID.

Activation Lock

When Find My is on for an iPhone, its paired watch can use Activation Lock. The "System security for watchOS" chapter says Activation Lock "requires the user's Apple Account and password to unpair, erase, or reactivate an Apple Watch." The broader "Activation Lock security" chapter adds that Activation Lock stays enabled even if the device is erased, which is exactly why the selling steps later in this post go through the iPhone.

How watchOS security updates are listed, and how quickly they track iOS

Apple's security releases page is the single source of truth. Apple says it does not disclose, discuss or confirm security issues until an investigation has finished and patches or releases are available, and that it references vulnerabilities by CVE ID where possible. Each watchOS row tells you three things: the version, which watches it is for, and the date. If the row links a page, that page lists each fix with the component (for example Kernel, WebKit, Wallet), the devices, the impact, a description and the CVE ID.

Two phrases on those pages are worth searching for:

• "may have been actively exploited" or "may have been exploited in an extremely sophisticated attack." Apple uses these when it knows of a report of exploitation, often against iOS rather than the watch.
• "This is a supplementary fix." Apple uses this when a later release hardens something that an earlier release already blocked.

Here is how quickly fixes Apple flagged as possibly exploited reached the watch, based on the dates on Apple's pages:

The pattern is that Apple usually ships a watchOS release on the same day when the bug is being exploited and affects the watch. When a fix arrives on iPhone in an unscheduled release, the watch can wait for its next scheduled point release. Those gaps are measured in weeks, not months, but they are real, and on an older watch line that no longer gets published CVE fixes the gap never closes.

This is not a claim that watches were attacked through these bugs. Most of Apple's notes describe exploitation "against versions of iOS." The watch shares the same kernel and WebKit code, so Apple ships the fix there too.

What health data the watch holds, and how it is protected

Apple Watch is often the main collector of Health data: heart rate, workouts, sleep, overnight vitals, medications and, with Family Setup, a child's daylight time. Apple Platform Security's "Protecting access to user's health data" chapter sets out how it is stored.

• Storage class. HealthKit data is stored in the Data Protection class "Protected Unless Open." Access is relinquished 10 minutes after the device locks and comes back at the next passcode, Face ID or Touch ID unlock.
• Locked-device journals. Records generated while the device is locked, for example during a workout, go into temporary journal files in the same class, then merge into the main database on unlock and are deleted.
• Management data. App permissions, connected device names and scheduling data are stored as "Protected Until First User Authentication."
• iCloud. Health data can be stored in iCloud. End-to-end encryption needs iOS 12 or later and two-factor authentication. Without them, data is still encrypted in storage and transit but not end to end.
• Local backups. A Finder or iTunes backup includes Health data only if the backup is encrypted.
• Clinical records. Records downloaded from a health system use OAuth 2 client credentials and a TLS 1.3 connection.
• Provenance. Each record carries metadata identifying the app that stored it and can carry a digitally signed copy in CMS format (RFC 5652) for records from a trusted device.

The app access rules are unusual and worth knowing. Read and write permissions are granted separately for each data type. If an app does not have read access, its queries return no data, the same response an empty database gives, so an app cannot infer your health status from which data types you track. Apps may not use Health data for advertising and must publish a privacy policy covering it. You can review and revoke access under Settings, then Health, then Data Access and Devices on the iPhone.

The watch adds one more layer: wrist detection. If the watch is off your wrist and locked, the Health data on it falls under the same Data Protection rules once the 10 minute window passes.

Step by step: check, update, harden and hand over an Apple Watch

There is no command line on Apple Watch, so most steps below are Settings paths from Apple's support articles. Step 2 uses real commands you can run on a Mac or Linux machine.

Step 1: find the watch's model and watchOS version

On the watch, open Settings, tap General, then About. You will see the watchOS version, model and serial number. On the iPhone, open the Apple Watch app, tap My Watch, then General, then About. Apple's "Identify your Apple Watch" article maps model numbers to names if you need to confirm whether a watch is a Series 8 or a Series 9.

Write down three things: the watchOS version, the model, and the iPhone's iOS version (Settings, General, About on the phone).

Step 2: check the version against Apple's security releases page

The security releases page is the only reliable way to know whether a given version is the newest one Apple ships for that watch. This short script fetches the page and prints every watchOS row with its devices and date. It uses only curl and Python's standard library.

mkdir -p ~/watchos-check && cd ~/watchos-check
curl -sL -A "Mozilla/5.0" https://support.apple.com/en-us/100100 -o apple-security-releases.html

# save as list_watchos.py and run: python3 -I list_watchos.py apple-security-releases.html
import html, re, sys

page = open(sys.argv[1], encoding="utf-8", errors="ignore").read()
for row in re.findall(r"<tr>(.*?)</tr>", page, re.S):
    cells = [
        re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", c))).strip()
        for c in re.findall(r"<td[^>]*>(.*?)</td>", row, re.S)
    ]
    if len(cells) >= 3 and cells[0].startswith("watchOS"):
        note = "no published CVEs" if "no published CVE" in cells[0] else "has CVE entries"
        name = cells[0].replace("This update has no published CVE entries.", "").strip()
        print(f"{cells[2]:>12}  {name:<16} {note:<18} {cells[1]}")

Find the newest row whose device list includes your model. If your watch is on an older version, update it. If the newest row for your model says "no published CVEs" and is years after the last row with CVE entries, the watch is past published security support, whatever the Software Update screen says.

For older years, run the same script on the archive pages linked at the bottom of the security releases page, such as https://support.apple.com/en-us/121012 (2022 to 2023) and https://support.apple.com/en-us/120989 (2020 to 2021).

Step 3: make sure the paired iPhone is current first

Apple's update article tells you to update the iPhone first. On the iPhone, open Settings, General, Software Update, and install the latest iOS. A watch cannot move to watchOS 27 unless the iPhone is on iOS 27, and some iOS updates require a watchOS update for data to keep syncing.

Step 4: update the watch

Apple's article lists the conditions: the watch at least 50 percent charged, the iPhone on Wi-Fi, both devices close together, and the watch on its charger. Then either:

• On the iPhone, open the Apple Watch app, tap My Watch, General, Software Update, and download the update. Enter the iPhone or watch passcode if asked.
• Or on the watch, connected to Wi-Fi, open Settings, General, Software Update, and tap Install.

Do not restart either device or quit the Watch app during the update. If you installed a beta, remove the beta profile in the Watch app (General, Profiles) and on the iPhone (Settings, General, Profiles and Device Management) before updating to the next major version. Remember that you cannot downgrade afterwards.

Step 5: check the security settings that matter

• Passcode. On the watch, Settings, Passcode. Use one. Without a passcode, Apple Pay and the protections in Data Protection have nothing to bind to.
• Wrist detection. In the Apple Watch app on the iPhone, under Passcode. Leave it on so the watch locks when removed.
• Find My and Activation Lock. On the iPhone, Settings, your name, Find My. When Find My is on for the iPhone, the paired watch gets Activation Lock.
• Lockdown Mode, only if you need it. On the iPhone, Settings, Privacy and Security, then Lockdown Mode. Turning it on for the iPhone turns it on for the paired watch, and incoming calls will no longer ring on the watch.
• Auto Unlock. On a Mac, the setting to use Apple Watch to unlock apps and the Mac; on the iPhone, Face ID and Passcode, Unlock with Apple Watch. Turn off any relationship you do not use.

Step 6: review health data sharing

On the iPhone, open Settings, Health, Data Access and Devices, and go through each app. Revoke read access for apps that do not need it. If you share Health data with family members or a care team from the Health app, review that list too and remove anyone who should no longer see it. If you back up the iPhone to a Mac, make sure the backup is encrypted, because only an encrypted backup includes Health data.

Step 7: track watches in a fleet

If you manage watches with device management (supported since watchOS 10), your MDM service reports each watch's OS version. Export that list on a schedule and compare it with the Step 2 output: any watch whose version is older than the newest row for its model needs an update, and any model whose newest row has no published CVE entries is due for replacement planning.

Step 8: unpair and erase before you sell or give a watch away

Warning: unpairing erases the watch and cannot be undone. Before you start, check that you are acting on the right device: read the serial number on the watch (Settings, General, About, then scroll to Serial Number) and confirm it matches the watch you are about to unpair in the Apple Watch app on the iPhone; Apple's serial number article shows both places. If you have more than one watch on the account, this check is the step that prevents erasing the wrong one. Also confirm your Health data is syncing to iCloud before you start.

Apple's "Unpair and erase your Apple Watch" steps, with the iPhone:

1. Keep the watch and iPhone close together.
2. On the iPhone, open the Apple Watch app, go to My Watch, and tap All Watches.
3. Tap the info button next to the watch you want to unpair, then tap Unpair.
4. For a cellular watch you are selling, remove the plan, and contact your carrier to cancel the subscription.
5. Enter your Apple Account password to disable Activation Lock, then tap Unpair.

If you no longer have the iPhone, you can erase on the watch (Settings, General, Reset, Erase All Content and Settings), but Apple is explicit that this "doesn't remove Activation Lock." The next owner will need your Apple Account and password. Apple also notes that Apple Watch has no SIM slot or reset button, and that the holes in the case are for sound and depth measurement, so do not insert anything into them.

Where Safeguard fits, honestly

Safeguard has no Apple Watch app and does not manage, update, scan or erase watches. Nothing Safeguard does changes how quickly Apple ships a watchOS fix, and the steps above are all Apple's.

The fit is in the software that surrounds a watch. Teams that build a watchOS app, its iPhone companion app, or the backend service that receives health or workout data are shipping open source dependencies in each of those, through Swift packages, JavaScript and Python services, and container images. Safeguard scans those repositories, SBOM files and images for known vulnerable components, shows which projects carry a given component and version, applies reachability analysis so the vulnerable code paths you call rank first, and can open fix pull requests through autonomous remediation, which ships switched off by default. That is the same discipline this post recommends for watches: know exactly what version you run, compare it with the vendor's list, and close the gap quickly.

Common mistakes

• Treating "Software Update says you're up to date" as "supported." It only means there is nothing newer for that model. A Series 3 on watchOS 8.8.2 is up to date and has had no published CVE fixes since June 2023.
• Updating the watch before the iPhone. The watch cannot move to a new major version until the paired iPhone is on the matching iOS.
• Assuming the watch got an iPhone emergency fix the same day. Usually it does, but in August 2022 and March 2025 the watch waited three to four weeks.
• Erasing a watch on the watch itself before selling it. That leaves Activation Lock on, and the buyer cannot use the watch.
• Turning off wrist detection for convenience. The watch then stays unlocked off the wrist until you lock it from Control Center, which weakens Apple Pay and Health data protection.
• Leaving Auto Unlock relationships on for old Macs or iPhones. Each relationship is a trust path. Remove the ones you no longer use.
• Assuming the compatibility article is the final word. In October 2026 it still lists Series 6 to Series 8 as "or later," while the update article caps them at watchOS 26.
• Making unencrypted local backups. Health data is left out of an unencrypted Finder or iTunes backup, and the rest of the backup is readable by anyone with the file.
• Granting every fitness app read access to all Health types. Permissions are per data type for a reason. Give each app only what it needs.

FAQ

What is the latest version of watchOS?

As of 24 October 2026, Apple's security releases page lists watchOS 27.0.1 as the latest, released 28 September 2026 for Apple Watch Series 9 and later (and 23 September 2026 for Series 12 and Ultra 4). The newest release for Series 6, 7, 8, SE (2nd generation) and the first Ultra is watchOS 26.6 from 27 July 2026.

Which Apple Watch models still get security updates?

Watches that can run the current major version get Apple's regular releases with published CVE fixes. In October 2026 that means Series 9 and later and Ultra 2 and later on watchOS 27. Series 6 to 8, SE 2 and the first Ultra are on watchOS 26, whose last listed release is 26.6. Series 5 and older have received builds since 2024, but Apple lists them with no published CVE entries.

Why is there no watchOS 12?

Apple moved all of its platforms to one version number in 2025. watchOS 26 was announced on 9 June 2025 alongside iOS 26, iPadOS 26, macOS Tahoe 26 and tvOS 26, so watchOS went straight from 11 to 26. In practice the number lines up with the year after release: the September 2026 release is watchOS 27.

Does Apple Watch support Lockdown Mode?

Yes, from watchOS 10. You do not turn it on separately: when you turn on Lockdown Mode on the iPhone, it is automatically turned on for the paired Apple Watch. Incoming calls will not ring on the watch while it is on.

How do I update my Apple Watch?

Update the iPhone first. Then put the watch on its charger with at least 50 percent battery, keep the iPhone nearby on Wi-Fi, and either open the Apple Watch app on the iPhone and go to General, Software Update, or open Settings on the watch and go to General, Software Update.

Is health data on Apple Watch encrypted?

Yes. HealthKit data uses the Data Protection class "Protected Unless Open," and access is relinquished 10 minutes after the device locks. Health data synced to iCloud is end-to-end encrypted when you use two-factor authentication and a passcode, and local backups include Health data only when they are encrypted.

How do I erase my Apple Watch before selling it?

Unpair it from the iPhone: Apple Watch app, My Watch, All Watches, the info button, Unpair, then enter your Apple Account password. This erases the watch and removes Activation Lock. Erasing from the watch alone leaves Activation Lock on.

Does Apple Watch get security fixes at the same time as iPhone?

Usually, when the bug affects both. Most fixes that Apple flagged as possibly exploited reached watchOS on the same day as iOS. We found two exceptions in this history: 26 days in 2022 and 21 days in 2025, when the iPhone fix shipped in an unscheduled release.

How is Apple Watch paired securely with iPhone?

The iPhone camera reads a secret from an animated pattern on the watch, with a six-digit PIN as a fallback. Keys are exchanged over an encrypted connection and, since watchOS 10, the watch's private keys are rooted in its Secure Enclave. With watchOS 26 and iOS 26, pairing adds ML-KEM-1024 and the ongoing link adds ML-KEM-768 for quantum security on top of elliptic-curve Diffie-Hellman.

Can I downgrade watchOS?

No. Apple's security releases page says that after a watchOS update is installed, it cannot be downgraded to the previous version.

Fix it without waiting for upstream

A watch itself takes its fixes from Apple, and nothing below changes that. The software around it is different: the watchOS app, its iPhone companion and the service that stores workout or health data all pull open source packages and base images, and every rebuild pulls them again, so the same version tracking this post applies to watches applies to them.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos touch an Apple Watch, read a watchOS version or change watch settings. Safeguard has no Apple Watch app. They show how Safeguard handles the software teams build around wearables, such as a watchOS app's dependencies, its iPhone companion and the services that receive its data.

The first demo is a real Safeguard CLI session: asked to fix a lodash CVE, the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow applies to the JavaScript service or build tooling behind a fitness or health app when a fixed version of a dependency exists.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. That is the route for scanning a watchOS and iOS app repository on the Mac where you build it, for example right after a dependency update.

Click through it at your own pace, or open it full screen.

The third demo is a real Android session with the Safeguard mobile app: you send work to a computer running the Safeguard CLI, then approve the command on the phone with Allow once, Allow for turn or Deny. The approval happens on a phone; the work runs on the computer. The same pattern lets a developer approve a dependency fix while away from the desk.

Click through it at your own pace, or open it full screen.

To try the CLI, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Apple security releases
• Apple security updates (2022 to 2023)
• Apple security updates (2020 to 2021)
• About the security content of watchOS 7.0
• About the security content of watchOS 7.6.2
• About the security content of watchOS 8
• About the security content of watchOS 8.8.1
• About the security content of watchOS 9
• About the security content of watchOS 9.6.2
• About the security content of watchOS 9.6.3
• About the security content of watchOS 10
• About the security content of watchOS 10.0.1
• About the security content of watchOS 10.6
• About the security content of watchOS 11
• About the security content of watchOS 11.4
• About the security content of watchOS 26
• About the security content of watchOS 26.2
• About the security content of watchOS 26.4
• About the security content of watchOS 26.5
• About the security content of watchOS 26.6
• About the security content of watchOS 27
• About the security content of iOS 15.6.1 and iPadOS 15.6.1
• Apple Platform Security: System security for watchOS
• Apple Platform Security: Automatically unlock Apple devices
• Apple Platform Security: Protecting access to user's health data
• Apple Platform Security: Lockdown Mode security
• Apple Platform Security: Activation Lock security
• Apple Support: About Lockdown Mode
• Apple Support: Apple Watch and iPhone compatibility
• Apple Support: Update your Apple Watch
• Apple Support: Unpair and erase your Apple Watch
• Apple Support: Identify your Apple Watch
• Apple Support: How to find the serial number or IMEI for your Apple Watch
• About the security content of iOS 18.3.2 and iPadOS 18.3.2
• NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
• Apple Developer: watchOS release notes
• Apple Newsroom: watchOS 7 (22 June 2020)
• Apple Newsroom: watchOS 8 (7 June 2021)
• Apple Newsroom: watchOS 9 (6 June 2022)
• Apple Newsroom: watchOS 10 (5 June 2023)
• Apple Newsroom: watchOS 11 (10 June 2024)
• Apple Newsroom: watchOS 26 (9 June 2025)
• Apple Newsroom: Apple introduces a delightful and elegant new software design (9 June 2025)

Last reviewed: 24 October 2026. Apple adds releases and edits security content pages over time; check the security releases page for the latest status.