iOS and iPadOS Security Releases
Apple releases iOS security patches outside any fixed calendar cadence. Major releases typically arrive every four to six weeks, but Rapid Security Responses (RSRs) for actively exploited vulnerabilities can appear days after an issue is discovered. RSRs patch a targeted component — most commonly WebKit, the browser engine underlying Safari and every in-app web view — without bumping the iOS version number.
Enterprise IT teams can deploy RSRs via MDM software update commands through BlackBerry UEM, Microsoft Intune, or Jamf.
Apple's iOS patch quality for enterprise deployments has improved markedly since the introduction of the declarative device management (DDM) framework in iOS 15. DDM allows MDM servers to declare a desired OS version state; the device is responsible for reaching that state autonomously, including scheduling the update installation during overnight maintenance windows without requiring persistent MDM connectivity. This reduces the dependency on MDM server uptime during patch deployment campaigns.
Apple Rapid Security Responses are delivered as delta updates and typically install in under 3 minutes without a reboot. Standard iOS updates require a reboot and should be deployed during maintenance windows declared via MDM policy.
Android Enterprise and Security Patch Levels
Google publishes the Android Security Bulletin on the first Monday of each month, disclosing CVEs fixed in that month's security patch level (SPL). The bulletin is split into two partial patch levels: YYYY-MM-01 covers the Google-owned AOSP components, while YYYY-MM-05 adds Qualcomm, MediaTek, and kernel fixes. A device carrying the YYYY-MM-05 patch level has received both sets.
Device manufacturers then integrate the bulletin into their own firmware builds, which introduces a device-specific delay of typically two to four weeks for flagship models and up to three months or longer for mid-range devices.
Samsung Galaxy enterprise devices track Google's bulletin most closely, releasing monthly Security Maintenance Releases (SMRs) that add Knox-specific patches on top of the AOSP bulletin. Enterprise IT teams managing mixed Android fleets should configure compliance policies in the MDM platform to enforce a minimum SPL, automatically flagging or quarantining devices that fall behind by more than 30 days.
For BlackBerry UEM, the Android Security Patch Level compliance condition is available under Compliance Profile > Android > Minimum Security Patch Level.
BlackBerry UEM Platform Updates
BlackBerry releases UEM major versions quarterly and maintenance releases (point releases) as needed for critical fixes. The release numbering follows a major.minor.patch scheme — for example, UEM 12.21.0 is the initial Q1 2026 major release, while UEM 12.21.1 is a maintenance release addressing specific CVEs or compatibility issues discovered after general availability. BlackBerry publishes release notes for each UEM version through the BlackBerry documentation portal (docs.blackberry.com).
Upgrading the UEM server is a planned maintenance activity that typically requires 30 to 90 minutes of downtime for the management console, depending on the size of the deployment and whether the database schema requires migration. Devices remain connected to the BlackBerry Infrastructure during UEM upgrades and continue to receive email and app pushes.
The UEM Management Console is unavailable during the upgrade window, which means new device enrollments, policy changes, and remote lock/wipe commands cannot be executed. Enterprises should schedule UEM upgrades during periods when device management demand is lowest and pre-stage critical remote wipe commands in advance if operational requirements demand them.
Microsoft Intune and Windows Mobile Security
Microsoft Intune receives continuous updates as a cloud-hosted service, with feature changes rolling out weekly through Microsoft's standard cloud deployment process. Security-relevant Intune changes are disclosed in the monthly Patch Tuesday bundle (second Tuesday of each month) for the Intune service and through the Microsoft 365 Message Center for advance notice of breaking changes to MDM policies or compliance configurations.
For Windows devices managed by Intune, Windows Update for Business (WUfB) provides the primary patch deployment mechanism, with Intune compliance policies enforcing minimum build version requirements. Organizations managing mobile devices alongside Windows endpoints in Intune should track both the Intune service updates and the Windows cumulative update cadence as separate patch domains with different deployment workflows and SLAs.
VMware Workspace ONE and Third-Party MDM Platforms
VMware Workspace ONE (now part of Broadcom's acquisition portfolio, marketed as VMware by Broadcom Workspace ONE) releases security patches through its standard product update cycle. Security bulletins for Workspace ONE are published through the VMware Security Advisories portal and assigned VMSA identifiers. On-premises Workspace ONE UEM deployments require manual upgrade installation by the customer; cloud-hosted (SaaS) deployments receive patches automatically.
Third-party MDM vendors — including JAMF Pro (macOS and iOS focus), Cisco Meraki Systems Manager, and Sophos Mobile — publish their own security advisories through their respective support portals. Enterprise IT teams running non-BlackBerry MDM platforms should subscribe to their vendor's security notification channels and maintain a current patch level for all MDM infrastructure components, treating the MDM control plane with the same security priority as the managed devices themselves.