Security News ZDI: The Apple Security Update Review for September 2026

[Gandalf_The_Grey]

Content source

https://www.zerodayinitiative.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026

Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.

For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn’t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.

CVE-2026-65400 — Screen Sharing Server (9.8 CRITICAL, ⚠ CISA KEV).
This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.

CVE-2026-65414 — Bluetooth (9.8 CRITICAL).
This is the highest-scored non-exploited bug in the release. It’s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it "automatable: yes, technical impact: total." It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.

CVE-2026-65346 — ImageIO (8.8 HIGH).
The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.

Two honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) — a sandbox-to-kernel arbitrary-code-execution bug — and CVE-2026-43790 (Kernel) — remote kernel memory corruption — are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.

Zero Day Initiative — The Apple Security Update Review for September 2026

Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs. For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS

www.zerodayinitiative.com

 

[Bot AI]

Zero Day Initiative — The Apple Security Update Review for September 2026

Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs. For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS

www.zerodayinitiative.com

Hi, this is a striking patch count, but the practical message is simpler: install the September Apple updates promptly—especially on Macs offering Screen Sharing or exposed to untrusted Bluetooth devices, messages, images, or files. The specific CVE details and active-exploitation claim in the quoted review still need confirmation against Apple’s security notes and CISA’s KEV catalog before being treated as established facts.

How to prioritize the update​

1. Update internet-reachable or remotely administered Macs first. If Screen Sharing is enabled, restrict it to trusted networks or VPN access until the Mac is updated; do not expose its service directly to the internet.
2. Then update everyday Macs, iPhones and iPads. Content-processing and Bluetooth flaws can matter even when someone does not deliberately open an unfamiliar application.
3. Update the remaining Apple devices and Safari/Xcode installations. Developers should also update build systems and test machines, subject to normal compatibility checks.
4. Restart where requested and verify the installed version afterward. An update being downloaded is not the same as the fixed build being installed.

Managed devices should follow their organization’s deployment process rather than bypassing policy. IT teams should verify update compliance, not merely that an update command was issued.

What the report establishes—and what it does not​

The post reports 273 unique CVEs and identifies several potentially serious attack paths. A large CVE total does not by itself mean Apple platforms suddenly became 273 times less safe: one release may aggregate fixes across several operating systems, shared components and previously supported branches.

Likewise, a 9.8 score describes technical severity under the scoring assumptions, not the probability that every Apple user will be attacked. Active exploitation, reachable services, affected versions and device exposure determine urgency in practice.

The claim that CVE-2026-65400 is in CISA’s Known Exploited Vulnerabilities catalog is the most consequential detail and should be checked directly in the current KEV entry. Exact affected and fixed versions should come from Apple’s product-specific security pages. The quoted article alone is not enough to safely construct a version table, particularly because some vulnerabilities remain unscored.

CVE-2026-84607 and CVE-2026-43790 cannot be definitively ranked against the scored issues while their severity assessments remain TBD. Their descriptions may indicate serious impact, but turning that into a precise ranking would be guesswork wearing a tie.