Apple’s September 2026 updates fix 273 security flaws across Macs, iPhones, iPads and several other product lines. Mac users should update promptly because one Screen Sharing flaw is already being exploited.
Apple does not provide CVSS severity scores, so the review used available ratings from the US National Vulnerability Database or CISA. Of the 273 flaws, 139 had not yet been scored when the review was published.
The component was initially patched on August 6 and then listed again because macOS 27 and Tahoe 26.7 now include the fix. The source does not describe who attackers are targeting or how widespread the exploitation is.
CVE-2026-65346 is an ImageIO flaw rated high severity. Processing a malicious image may run code, and images can appear automatically in places such as Messages and previews.
Two potentially serious flaws remained without NVD scores: CVE-2026-84607 could let a restricted app run code with kernel privileges, while CVE-2026-43790 could cause remote kernel memory corruption. Kernel privileges provide deep control over the operating system.
Who needs the updates
Dustin Childs at www.thezdi.com reports that the release covers macOS 27, macOS Tahoe 26.7, macOS Sequoia 15.8, iOS and iPadOS 27 and 26.7, plus visionOS, watchOS, tvOS, Safari and Xcode 27.Apple does not provide CVSS severity scores, so the review used available ratings from the US National Vulnerability Database or CISA. Of the 273 flaws, 139 had not yet been scored when the review was published.
- On a Mac, install the newest compatible macOS update, particularly if Screen Sharing is enabled.
- Update iPhones, iPads, Apple Watches, Apple TVs and Vision Pro devices because the critical Bluetooth flaw reaches all eight operating-system platforms listed in the review.
- Avoid opening unexpected images until updated; one ImageIO flaw can run attacker-controlled code when a malicious image is processed.
The most urgent Mac flaw
CVE-2026-65400 affects the Screen Sharing Server in macOS 27 and macOS Tahoe 26.7. CISA lists it in its Known Exploited Vulnerabilities catalog, which tracks security bugs confirmed as used in attacks.The component was initially patched on August 6 and then listed again because macOS 27 and Tahoe 26.7 now include the fix. The source does not describe who attackers are targeting or how widespread the exploitation is.
Bluetooth and image handling also stand out
CVE-2026-65414 is a critical Bluetooth flaw that could let a remote attacker crash an app or run code. It affects the listed versions of iOS, iPadOS, macOS, tvOS, watchOS and visionOS, but the review did not report active exploitation.CVE-2026-65346 is an ImageIO flaw rated high severity. Processing a malicious image may run code, and images can appear automatically in places such as Messages and previews.
Two potentially serious flaws remained without NVD scores: CVE-2026-84607 could let a restricted app run code with kernel privileges, while CVE-2026-43790 could cause remote kernel memory corruption. Kernel privileges provide deep control over the operating system.
