Apple Updates Everything, (Mon, Sep 14th)

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

CVE-2026-20683 is an authentication weakness in Apple's Sign In With Apple flow caused by improper state management, allowing an app on the device to abuse the authentication flow and gain access to the user's Apple Account. Exploitation requires a malicious or vulnerable app already present on an affected iPhone, iPad, Mac, or Vision Pro; no separate network exposure is needed. A successful attacker could potentially access the victim's Apple Account, which typically gates iCloud data, purchases, and linked services. The flaw affects devices running iOS/iPadOS versions prior to 27, macOS prior to Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and visionOS prior to 27, all fixed in Apple's September 2025 release wave. No public proof-of-concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

Do: Update all Apple devices immediately to iOS 27 / iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, or visionOS 27, and use MDM or Apple's rapid security response tooling to force fleet-wide patching. Review the list of apps authorized to use Sign In With Apple (Settings > Apple Account > Sign-In and Security) and revoke access for any untrusted or unknown third-party apps. Audit enterprise app inventories for apps that initiate Sign In With Apple flows, since a malicious app on the device is the delivery vector.

CVE-2026-28899 is a logic flaw in Apple's Gatekeeper security mechanism on macOS that allows a malicious app to bypass Gatekeeper's validation checks. Gatekeeper normally verifies that downloaded apps are notarized and signed before allowing them to run; a bypass means an attacker-controlled app downloaded to a victim's Mac could execute without passing those checks or triggering the standard user-approval flow. Successful exploitation gives an attacker a way to launch untrusted code on target machines, which is typically used as an initial-access step that is chained with other flaws to escape sandboxes or gain elevated privileges. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.6, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved checks in its September 14 broad software update. As of the available data, there is no public proof-of-concept, no CVSS score, and no evidence of in-the-wild exploitation.

Do: Update affected Macs immediately: macOS Sequoia to 15.8, macOS Tahoe to 26.6 or 26.7, or macOS Golden Gate to 27 via System Settings > Software Update. On managed fleets, verify patch compliance and confirm Gatekeeper is enabled (e.g., `spctl --status` reports assessments enabled). Gatekeeper bypasses are commonly chained with browser exploits and sandbox escapes, so treat rapid patching as high priority and monitor Apple's security advisories for follow-on CVEs.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.

CVE-2026-43692 is an input validation and sanitization weakness in Apple's macOS that allows a remote attacker to cause unexpected application termination or execute arbitrary code on an affected Mac. The exact component and attack vector were not specified in the advisory, but flaws of this class are typically triggered by tricking a target into processing maliciously crafted content or input, and exploitation would let an attacker crash apps or run code in the context of the vulnerable process. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, or macOS Golden Gate before 27 are affected; Apple patched the issue in those releases, which shipped alongside the company's broad September security updates. The vulnerability has no CVSS score yet, no public proof-of-concept is known, and it is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no observed in-the-wild exploitation at this time.

Do: Update affected Macs immediately to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > Software Update, and prioritize the update in MDM/patch management since arbitrary code execution flaws in macOS are prime targets once details emerge. There is no published workaround, so patching is the primary mitigation. After patching, monitor Apple's security advisory and threat intel feeds for the affected component and any emerging exploitation before this CVE receives a CVSS score.

CVE-2026-28935 is a kernel memory-handling flaw affecting Apple's operating systems across iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro. A malicious or compromised app running on an affected device may be able to corrupt kernel memory or cause unexpected system termination (crash/DoS), and kernel memory corruption issues of this class can potentially be leveraged to escape app sandboxing or elevate privileges, though Apple's advisory only confirms corruption and termination. Exploitation requires local code execution — an attacker must first get a victim to install and run a malicious app, or compromise an already-installed app. Apple addressed the issue with improved memory handling in iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. No public proof of concept is known, the flaw is not on the CISA KEV list, and there are no reports of in-the-wild exploitation.

Do: Patch all Apple devices promptly: iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27 (paired iPhone updates are required to update watchOS). Enable automatic updates and verify patch levels across managed device fleets via MDM. Because the flaw is triggered by a local app, restrict sideloading and untrusted third-party app sources and review recently installed apps for suspicious behavior until devices are patched.

CVE-2026-28937 is a state-management flaw in Apple macOS that can allow an app running on a Mac to access sensitive user data that it should not be permitted to read. The issue is triggered locally: an attacker would need to get a malicious app onto the victim's machine, or abuse an already-installed app, rather than attacking the system remotely over a network. Successful abuse results in unauthorized access to sensitive user information — a privacy/information-disclosure impact — not remote code execution. The flaw affects Macs running macOS versions prior to the fix; Apple addressed it through improved state management and shipped the patch in macOS Golden Gate 27 as part of a broad September software update. CVSS has not yet been scored, no public proof-of-concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update to macOS Golden Gate 27 or later via System Settings > General > Software Update as soon as possible, and have IT admins expedite deployment across managed Mac fleets. Because the flaw is app-mediated, review and restrict permissions granted to third-party apps and avoid installing untrusted software. No configuration workaround is documented, so patching is the primary mitigation.

CVE-2026-28966 is an out-of-bounds write flaw caused by insufficient bounds checking in Apple's operating systems, patched across iOS/iPadOS, macOS, tvOS, and visionOS. It is triggered when a device processes a maliciously crafted file, meaning an attacker needs to deliver a booby-trapped file to the target (e.g., via a message, download, or web content). Apple's stated impact is unexpected app termination (a denial-of-service condition), though out-of-bounds writes are a memory-corruption class that can potentially be escalated to arbitrary code execution depending on the affected component. All users on iOS/iPadOS prior to 26.7 or 27, macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate prior to 27, tvOS prior to 27, and visionOS prior to 27 are affected. No CVSS score has been assigned, the flaw is not on the CISA KEV list, and no public proof-of-concept or in-the-wild exploitation is known.

Do: Update all Apple devices promptly: iPhone/iPad to iOS/iPadOS 26.7 or 27, Macs to macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, Apple TV to tvOS 27, and Vision Pro to visionOS 27 (Settings > General > Software Update). Enable automatic updates and use MDM to force patch deployment across managed fleets. Treat unsolicited files, attachments, and media from untrusted sources with caution until patched, since the flaw is triggered by processing a maliciously crafted file.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.

CVE-2026-43684 is a use-after-free vulnerability in Apple's kernel memory management affecting iOS, iPadOS, and macOS. The flaw is triggered by an app running on the device: a malicious or already-compromised app may be able to cause unexpected system termination or corrupt kernel memory. Kernel memory corruption of this class is significant because it can potentially be developed into a privilege-escalation or sandbox-escape primitive, though Apple's advisory describes only termination and corruption as the impact. Users on iOS and iPadOS versions prior to 26.7, macOS Sequoia prior to 15.8, and macOS Golden Gate prior to 27 are affected, with fixes shipped in iOS/iPadOS 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27. No public proof-of-concept is known and there is no indication of in-the-wild exploitation at this time.

Do: Patch iPhones and iPads to iOS/iPadOS 26.7 and Macs to macOS Sequoia 15.8 or macOS Golden Gate 27, pushing the updates via MDM on managed fleets as a priority. Because exploitation requires a malicious or already-compromised app on the device, audit installed apps and restrict sideloading or non-App Store software on high-value endpoints. Monitor Apple's security advisory for researcher credit and any added exploitation notes, since kernel use-after-free bugs are common building blocks in full exploit chains and should not sit unpatched.

CVE-2026-43674 is an authentication flaw in Apple's iOS and iPadOS caused by improper state management in the handling of sensitive settings. It is triggered when an attacker has physical access to a device that is already unlocked, allowing them to view saved Wi-Fi passwords without passing any additional authentication prompt. Successful abuse reveals stored Wi-Fi network credentials, which an attacker could reuse to join and position themselves on those networks for further attacks. The issue is fixed in iOS 27 and iPadOS 27, meaning devices running earlier releases remain exposed. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Update iPhones and iPads to iOS 27 or iPadOS 27 as soon as rollout reaches your devices, and prioritize shared or helpdesk-managed devices. Because exploitation requires physical access to an unlocked device, require immediate auto-lock with short timeouts and avoid leaving unlocked devices unattended or handing them to untrusted parties. Administrators should audit managed-device update compliance and treat leaked Wi-Fi credentials as rotatable secrets if devices were exposed.

CVE-2026-43683 is an out-of-bounds read in Apple's macOS that was fixed with improved bounds checking. A malicious or compromised app running on an affected Mac can trigger the flaw to cause unexpected process termination (a crash) or to disclose process memory, potentially exposing sensitive data held in that process such as tokens or other secrets. The flaw affects macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27, with fixes shipping in Apple's broad September 14 'Updates Everything' release wave. No CVSS score has been assigned yet, no public proof of concept exists, and there is no evidence of exploitation in the wild.

Do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > General > Software Update. Since exploitation requires a malicious app on the Mac, enforce Gatekeeper/notarization policies and restrict software installs to trusted sources. On managed fleets, audit recently added third-party apps and confirm patch compliance against Apple's September security advisory.

CVE-2026-43686 is a use-after-free vulnerability in Apple's kernel NFS client, disclosed in Apple's September 2026 mass update. It is triggered when a device connects to (mounts a share from) a malicious NFS server, which can lead to kernel memory corruption — typically enough to crash the device or potentially execute code with kernel privileges. All unpatched iPhones, iPads, Macs, Apple TVs, Vision Pro headsets, and Apple Watches are affected, though practical exploitation requires the target to actually connect to an attacker-controlled NFS server, which is uncommon for consumers and mostly plausible in enterprise/managed-network or automount scenarios. No CVSS score has been assigned, no public proof-of-concept is known, and the flaw is not in the CISA KEV catalog, with no reports of in-the-wild exploitation. The issue was fixed with improved memory management in the September 2026 OS releases.

Do: Patch to the fixed releases: iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Users and admins should avoid mounting NFS shares from untrusted networks or unknown servers, and enterprise teams should audit automount/NFS configuration profiles so managed devices only connect to vetted NFS infrastructure. Watch for a CVSS score and any follow-on advisory, since kernel memory corruption flaws in Apple platforms are frequently combined with other bugs in chained attacks.

CVE-2026-43688 is a memory corruption vulnerability in Apple's operating systems caused by insufficient input validation during file processing. It is triggered when a device processes a maliciously crafted file, and Apple's advisory lists unexpected app termination (denial of service) as the observed impact, though memory corruption flaws carry inherent risk of worse outcomes depending on the underlying defect. The issue was fixed with improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27, meaning all iPhones, iPads, and Macs running earlier releases are affected. No CVSS score has been assigned yet, and there is no known public proof of concept or evidence of in-the-wild exploitation.

Do: Update iPhones and iPads to iOS/iPadOS 27 and Macs to macOS Golden Gate 27 or later as soon as the September updates are available. Until devices are patched, advise users to avoid opening files, attachments, or downloads from untrusted or unexpected sources, since the flaw is triggered simply by processing a maliciously crafted file. Monitor for a CVSS assignment and any CISA KEV listing, which would signal elevated active-exploitation risk.

CVE-2026-43690 is a race condition in Apple's macOS caused by insufficient locking, which Apple addressed with improved locking mechanics. A local attacker with an existing account on an affected Mac could exploit the timing flaw to read portions of kernel memory, potentially exposing sensitive data such as pointers, credentials, or secrets that could aid in further privilege-escalation or sandbox-escape chains. Only users on unpatched macOS versions are affected; the fix ships in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue requires local access, so remote exploitation is not in scope. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Patch affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) as soon as practical via Software Update or your MDM deployment. Because exploitation requires local access, enforce least-privilege local account policies, limit who can run arbitrary code on shared or lab Macs, and review logs for suspicious local privilege-elevation attempts.

CVE-2026-43695 is an authorization issue caused by improper state management in Apple's operating systems, fixed across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS in the September 2026 updates. A malicious or poorly behaved app running on an unpatched device could exploit inconsistent permission state to access sensitive user data beyond what it was authorized to see. Exploitation requires a victim to run the attacker's app on an affected iPhone, iPad, Mac, Apple TV, Apple Watch, or Vision Pro; no user interaction with a remote attacker is implied. All users on versions prior to the fixed releases listed in Apple's advisory are affected. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Patch all Apple devices to the fixed releases: iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Enterprise admins should push these updates via MDM and prioritize them since the flaw allows apps to read sensitive user data. Users and defenders should also audit installed apps and review app permissions under Settings > Privacy & Security to remove any untrusted apps with broad data access.

An authorization flaw in macOS, caused by insufficient entitlement checks, allows a locally installed app to capture Touch Bar content without the user's permission. A malicious or compromised app on an affected Mac could passively read whatever is displayed on the Touch Bar — which can include predictive-text suggestions and app-specific input — making this a keystroke-adjacent privacy leak rather than a remote attack. The issue is fixed in macOS Golden Gate 27 and affects Macs with Touch Bar hardware (2016–2019 MacBook Pro models) running earlier macOS versions. Exploitation requires the attacker to already run an app on the target Mac, so the practical risk is local snooping by untrusted software. No CVSS score has been assigned yet, there is no public proof of concept, no CISA KEV entry, and no known exploitation; the fix shipped in Apple's broad September update wave.

Do: Upgrade all Touch Bar–equipped Macs to macOS Golden Gate 27 or later, and confirm which older units are eligible for the update, since Touch Bar hardware that cannot upgrade may remain exposed. Because exploitation requires a local app, audit installed software and screen-capture/TCC permission grants on these machines. Treat unpatched Touch Bar Macs as carrying a typed-input privacy risk and avoid running untrusted apps on them.

An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

CVE-2026-43702 is a memory-handling flaw in Apple's operating systems that is triggered when a device processes a maliciously crafted video file. Successful exploitation can cause unexpected app termination (denial of service) or corruption of process memory, which in Apple's own disclosure language creates a memory-corruption condition in the media-handling path. The flaw affects iPhones, iPads, Macs (both macOS Sequoia and Tahoe), Apple TV, and Apple Watch, and was addressed with improved memory handling in Apple's September updates. There is no CVSS score yet, no public proof-of-concept, and no indication of in-the-wild exploitation. Users are exposed primarily through playing or previewing video files received from untrusted sources, such as messaging attachments or downloads.

Do: Patch all Apple devices to the fixed releases: iOS/iPadOS 26.6 or 26.7, macOS Sequoia 15.8 or macOS Tahoe 26.6/26.7, tvOS 26.6, and watchOS 26.6, prioritizing via MDM in managed fleets. Instruct users to avoid opening or previewing video files from untrusted sources. Treat reports of apps crashing or behaving erratically during video playback as a potential indicator and verify OS versions fleet-wide.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.