Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

CVE-2026-43692 is an input validation and sanitization weakness in Apple's macOS that allows a remote attacker to cause unexpected application termination or execute arbitrary code on an affected Mac. The exact component and attack vector were not specified in the advisory, but flaws of this class are typically triggered by tricking a target into processing maliciously crafted content or input, and exploitation would let an attacker crash apps or run code in the context of the vulnerable process. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, or macOS Golden Gate before 27 are affected; Apple patched the issue in those releases, which shipped alongside the company's broad September security updates. The vulnerability has no CVSS score yet, no public proof-of-concept is known, and it is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no observed in-the-wild exploitation at this time.

Do: Update affected Macs immediately to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > Software Update, and prioritize the update in MDM/patch management since arbitrary code execution flaws in macOS are prime targets once details emerge. There is no published workaround, so patching is the primary mitigation. After patching, monitor Apple's security advisory and threat intel feeds for the affected component and any emerging exploitation before this CVE receives a CVSS score.

CVE-2026-84607 is a race condition (CWE-362) in Apple's operating systems that was fixed with improved state management, allowing a sandboxed app to execute arbitrary code with kernel privileges. Exploitation requires a malicious or compromised app already running on the device (local vector, low privileges, no user interaction), which then abuses a timing window in kernel state handling to break out of the sandbox. A successful exploit yields full kernel-level code execution — the highest privilege tier on Apple platforms — making this a prime component for chaining with initial-code-execution bugs such as browser or app flaws. All iPhones, iPads, Macs, Apple TVs, Apple Watches, and Vision Pros running OS versions older than the listed fixes are affected. No public proof of concept exists, the flaw is not on CISA's KEV list, and no exploitation in the wild has been reported.

Do: Patch all Apple devices to the fixed releases — iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 — and use MDM to push and verify updates fleet-wide. Because this flaw converts any sandboxed-app foothold into kernel code execution, it is a high-value chaining link; restrict sideloaded or untrusted apps and monitor for anomalous behavior from third-party software on unpatched devices.

CVE-2026-64753 is an improper privilege management (permissions) vulnerability in Apple's browser and operating system software that Apple fixed by removing the vulnerable code. It is triggered when a device processes maliciously crafted web content — typically a user visiting an attacker-controlled webpage — requiring user interaction but no privileges or attacker access to the device. Successful exploitation can disclose sensitive user information, reflected in a CVSS 3.1 base score of 6.5 (network vector, low attack complexity, high confidentiality impact, no integrity or availability impact). The flaw affects Safari and Apple's full OS lineup before the version 27 release wave — iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS — which shipped as part of a broad Apple update addressing 273 vulnerabilities. No public proof of concept is known, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed.

Do: Update all Apple devices and browsers to the fixed releases: Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, prioritizing iPhones and Macs used for web browsing. Because exploitation requires a user to load malicious web content, advise users to avoid untrusted links until patched. IT admins should verify update compliance across managed device fleets and monitor for post-update browsing anomalies indicating possible information disclosure.

CVE-2026-65393 is a permissions/validation weakness in Apple's macOS (and related tooling in Xcode) in which an app running on an affected system may be able to access user-sensitive data that it should not be permitted to read. Exploitation requires a malicious or compromised application to already be present and executing on the victim's Mac, where it abuses the insufficient permission validation rather than a remotely reachable network flaw. A successful abuser gains access to sensitive user data (for example, data protected by macOS privacy controls), but there is no indication of arbitrary code execution or remote compromise. The issue affects users running macOS versions prior to macOS Golden Gate 27, as well as developers on Xcode versions prior to Xcode 27, since fixes shipped in both releases as part of a large Apple security update. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in the CISA KEV catalog.

Do: Update to macOS Golden Gate 27 as soon as practical, and developers should move to Xcode 27 so apps are built against the corrected validation behavior. In the interim, audit installed applications and the permissions granted under System Settings > Privacy & Security, revoking unusual data-access grants and removing untrusted apps, since exploitation depends on a malicious app already running locally. Monitor Apple's security advisory and threat feeds, as this flaw was patched alongside a very large batch of fixes that attackers may prioritize for reverse engineering.

Apple patched a critical out-of-bounds write (CWE-787) memory-corruption flaw spanning nearly its entire operating-system lineup: iOS, iPadOS, macOS (Sequoia, Tahoe, Golden Gate), tvOS, visionOS, and watchOS. A remote attacker could trigger the flaw with no privileges and no user interaction (CVSS 3.1: 9.8, network vector, low complexity), causing unexpected app termination or potentially arbitrary code execution on the affected device. The advisory does not identify the vulnerable component or exact trigger, so defenders should assume any affected system is remotely attackable until patched. All users running iOS/iPadOS before 26.7, macOS Sequoia before 15.8, macOS Tahoe before 26.7, or pre-release tvOS/visionOS/watchOS builds older than 27 are affected. No public proof of concept exists, no exploitation in the wild is known, and the flaw is not on CISA's KEV list; fixes shipped in the listed updates.

Do: Update all Apple devices promptly: iPhones/iPads to iOS/iPadOS 26.7 or 27, Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, Apple TV to tvOS 27, Apple Watch to watchOS 27, and Vision Pro to visionOS 27. Enable automatic security updates and use MDM/inventory to find devices still on older OS trains. Given the 9.8 CVSS with no user interaction required, treat patching as high priority even though no exploitation has been observed.

CVE-2026-65400 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in Apple macOS's Screen Sharing service, caused by an authentication state-management defect. An attacker who can reach a vulnerable Mac's Screen Sharing service over the network can authenticate without valid credentials, gaining full remote access with high impact to confidentiality, integrity, and availability. All three currently supported macOS branches are affected: Sequoia, Sonoma, and Tahoe, in versions prior to the fixed releases. The flaw is being actively exploited on the internet, with public reporting that attackers use the bypass to deploy Monero cryptominers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18. EPSS estimates a 9.9% probability of exploitation within 30 days (95th percentile).

Do: Upgrade to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1 (or later) immediately; patching is mandatory for federal agencies under CISA BOD 26-04 given the KEV listing. As an interim mitigation, disable Screen Sharing or restrict it via firewall/VPN so VNC (port 5900) is not reachable from the internet. Review internet-exposed Macs for signs of compromise, especially unexplained Monero miner processes or abnormal CPU usage.

CVE-2026-86898 is a logic flaw caused by improper state management in Apple's handling of webarchive files, which are saved web page bundles produced by Safari. An attacker triggers the bug by convincing a victim to open a maliciously crafted .webarchive file, after which the attacker achieves universal cross-site scripting (UXSS) — the ability to run attacker-controlled script in the security context of arbitrary websites, effectively bypassing the same-origin policy. Successful exploitation can lead to session/token theft, impersonation of the victim on any site they use, and manipulation of content in other origins. The flaw affects Safari, iOS, iPadOS, macOS Golden Gate, and visionOS, and is fixed in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. No public proof of concept is known and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, though the fix shipped as part of a large coordinated Apple security update.

Do: Patch to Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 as soon as rollout permits, prioritizing devices that regularly receive files from outside the organization. Instruct users not to open unsolicited or untrusted .webarchive files, and consider blocking or sandboxing .webarchive attachments at mail and download gateways until patching completes. Use MDM compliance reporting to verify all managed Apple devices have applied the 27-series updates.