Apple Updates Everything, (Mon, Sep 14th)
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.
- Record 261 vulnerabilities patched across all Apple operating systems
- No vulnerabilities flagged as actively exploited in the wild
- Kernel root privilege escalations and remote CUPS code execution included
- Third-party tools like Little Snitch require updates before macOS 27 upgrade
- CVEs
- CVE-2022-3437CVE-2026-20683CVE-2026-28899CVE-2026-28930CVE-2026-28934CVE-2026-28935CVE-2026-28937CVE-2026-28966CVE-2026-28968CVE-2026-28969CVE-2026-34979CVE-2026-43661CVE-2026-43664CVE-2026-43674CVE-2026-43677CVE-2026-43683CVE-2026-43684CVE-2026-43686CVE-2026-43687CVE-2026-43688CVE-2026-43689CVE-2026-43690CVE-2026-43691CVE-2026-43692CVE-2026-43695CVE-2026-43696CVE-2026-43697CVE-2026-43698CVE-2026-43702CVE-2026-43715
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-3437 | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal | 6.5 | 4% | ||
| CVE-2026-43686 | Kernel Use-After-Free in Apple NFS Client Across iOS, macOS, and watchOS | 8.8 group max | — | ||
| CVE-2026-43692 | Input Validation RCE Flaw in Apple macOS (Sequoia, Tahoe, Golden Gate) | 8.8 group max | — | ||
| CVE-2026-28930 | A permissions issue was addressed with additional restrictions | 7.5 | <1% | ||
CVE-2026-43661+1 related CVE | A buffer overflow issue was addressed with improved memory handling | 7.5 | <1% | ||
| CVE-2026-34979 | OpenPrinting CUPS: In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings… | 5.3 | <1% | PoC | |
| CVE-2026-43698 | An injection issue was addressed with improved validation | 7.8 | <1% | ||
| CVE-2026-43715 | A use-after-free issue was addressed with improved memory management | 8.8 | <1% |
From the original article
14 min read at isc.sans.edu
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors&#;x26;#;39; "post-AI" patch releases.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.