The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

CVE-2026-65374 is an out-of-bounds write (memory corruption) flaw in Apple macOS's handling of WebDAV connections, rated 8.8 (high) with network vector, low attack complexity, no privileges required, but user interaction required. It is triggered when a victim connects to an attacker-controlled WebDAV server — for example by clicking a webdav:// link or mounting an untrusted WebDAV share via Finder's 'Connect to Server' — and the malformed server responses corrupt memory in the WebDAV client code. Successful exploitation can yield arbitrary code execution with the privileges of the connecting user, impacting confidentiality, integrity, and availability. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved validation. No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Patch to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (System Settings > Software Update), prioritizing fleets where users mount network shares. Advise users not to click webdav:// links or connect to WebDAV servers from untrusted sources, since the flaw requires user interaction. Egress/URL filtering can also block or flag webdav:// schemes and unexpected outbound WebDAV (TCP 80/443 with WebDAV methods) as a defense-in-depth measure.

CVE-2026-43689 is a permissions issue in Apple's operating systems where insufficient restrictions allowed a malicious application to elevate itself to root privileges, effectively breaking out of the app sandbox. Exploitation is local: an attacker must first get a malicious app onto the victim's iPhone, iPad, Mac, or Vision Pro, after which the flaw grants the app full root control of the device. Root access on these platforms exposes sensitive user data and enables deep persistence on the compromised device. Apple addressed the issue with additional restrictions in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, and visionOS 27, released as part of Apple's September 'Updates Everything' wave. No public proof of concept is known, the flaw is not on the CISA KEV list, and there are no reports of in-the-wild exploitation.

Do: Patch promptly: update iPhones and iPads to iOS/iPadOS 26.7 or later (or iOS/iPadOS 27), Macs to macOS Golden Gate 27, and Vision Pro headsets to visionOS 27 as soon as the rollout reaches the device. Because exploitation requires a malicious app to already be installed, audit installed apps and remove anything sideloaded, enterprise-signed, or from untrusted sources, and keep installations limited to the App Store. MDM administrators should push these updates fleet-wide and review device logs for unexpected privilege-escalation or sandbox-escape behavior.

CVE-2026-43690 is a race condition in Apple's macOS caused by insufficient locking, which Apple addressed with improved locking mechanics. A local attacker with an existing account on an affected Mac could exploit the timing flaw to read portions of kernel memory, potentially exposing sensitive data such as pointers, credentials, or secrets that could aid in further privilege-escalation or sandbox-escape chains. Only users on unpatched macOS versions are affected; the fix ships in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue requires local access, so remote exploitation is not in scope. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Patch affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) as soon as practical via Software Update or your MDM deployment. Because exploitation requires local access, enforce least-privilege local account policies, limit who can run arbitrary code on shared or lab Macs, and review logs for suspicious local privilege-elevation attempts.

CVE-2026-43719 is a use-after-free flaw (CWE-416) in the way macOS handles SMB network shares, addressed by Apple with improved memory management. An attacker triggers it by convincing a user to mount a maliciously crafted SMB share — for example through an smb:// link or an attacker-controlled file server on the network — and successful exploitation causes the affected Mac to terminate (a crash or kernel-level denial of service). The CVSS 3.1 vector (6.5, A:H) shows the impact is availability only, with no indicated path to code execution or data theft, though a repeatable crash gives a reliable remote DoS against any user who mounts the share. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and the vulnerable SMB client ships in standard macOS installs. It was fixed as part of a record-setting Apple patch batch; no public proof of concept or in-the-wild exploitation is known, and it is not on the CISA KEV list.

Do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > General > Software Update. Instruct users not to mount SMB shares from untrusted servers and to be cautious with unsolicited smb:// links that prompt to connect. Admins should treat this patch batch — reported as record-setting in size — as a priority rollout and verify update compliance across their Mac fleets.

Apple patched a validation and input sanitization flaw in macOS that allows an app to read arbitrary files on the system, bypassing the file-access restrictions normally enforced for third-party apps. Exploitation requires a locally installed app invoking the affected component, so an attacker must first get their app onto a victim's Mac (e.g., via sideloading, a compromised or repackaged legitimate app, or an app that slips past review). Successful abuse can expose any file accessible to the logged-in user — documents, credentials, keychains, and configuration data — though the flaw does not by itself grant code execution or remote access. All Macs running macOS versions older than Sequoia 15.8, Tahoe 26.7, or Golden Gate 27 are affected. No CVSS score has been assigned, no public proof-of-concept exists, and the issue is not on CISA's Known Exploited Vulnerabilities catalog; the fix shipped as part of a record-setting wave of Apple security patches.

Do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > Software Update on all managed and personal Macs. Because exploitation requires a locally running app, audit installed third-party apps and remove untrusted or non-essential ones, and treat sideloaded or repackaged apps with heightened scrutiny. Monitor for a CVSS score, public PoC, or KEV listing as analysis of Apple's record-setting patch batch progresses.

CVE-2026-64790 is a path handling vulnerability in Apple's macOS in which insufficient validation of file paths allows a malicious or compromised application to gain elevated privileges on the system. Exploitation is local: an attacker must first get their app running on a target Mac, then abuse the flawed path handling to escalate beyond the app's normal permissions. The issue was fixed with improved validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, so Macs running earlier builds of these release lines remain exposed. NVD has not yet assigned a CVSS score, there is no known public proof-of-concept, and the flaw is not in CISA's KEV catalog, though it shipped as part of a record-setting batch of Apple patches. No exploitation in the wild has been reported.

Do: Update affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 or later via System Settings > General > Software Update, and verify patch status across the fleet. Because exploitation requires a local app to be running, keep Gatekeeper and notarization enforcement enabled, restrict installation of unvetted software, and monitor endpoint logs for apps spawning higher-privilege processes. Note this fix landed in a record-sized Apple update wave, so triage the other CVEs patched in the same releases as well.

An authentication weakness in macOS allows an app running on an affected Mac to cause unexpected system termination, effectively a local denial-of-service condition. The flaw is triggered when an app invokes a privileged system operation without the caller being properly authenticated, leading the system to crash or restart rather than rejecting the request. An attacker gains only an availability impact — repeated reboots or crashes of a victim's Mac — with no indication of code execution or data exposure. Affected users are those on macOS versions prior to the fixes, which shipped in macOS Sequoia 15.8, macOS Tahoe 26.6, and macOS Golden Gate 27 as part of a record-setting Apple patch batch. No public proof-of-concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is presumed limited or absent.

Do: Update to macOS Sequoia 15.8, macOS Tahoe 26.6, or macOS Golden Gate 27 as appropriate for your hardware, since the fix strengthens the authentication check that prevents apps from terminating the system. Restrict app installations to trusted, notarized sources such as the App Store, and enable Gatekeeper to reduce the chance of running a malicious app that could abuse this. Check logs for unexpected shutdowns or kernel panics that may indicate past abuse of this behavior.

CVE-2026-65376 is an out-of-bounds read vulnerability in Apple's macOS caused by insufficient bounds checking, which Apple addressed with improved validation. It is triggered when an app on an affected Mac performs the out-of-bounds memory read, allowing that app to cause unexpected system termination — effectively a denial-of-service crash of the machine. While out-of-bounds reads can sometimes expose memory contents, Apple's advisory only documents the crash impact, so data disclosure should not be assumed. Users on any macOS version older than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 are affected, and the flaw was disclosed amid a record-setting wave of Apple security patches. No public proof of concept exists, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported.

Do: Update to macOS Tahoe 26.7, macOS Sequoia 15.8, or macOS Golden Gate 27 via Software Update as soon as the fixed builds are available. Because exploitation requires running a malicious app, keep Gatekeeper enabled and restrict installations to App Store or notarized software. On unpatched Macs, investigate unexpected system terminations or crash logs as a potential indicator of abuse.

CVE-2026-65406 is a logic flaw caused by insufficient validation in Apple's operating systems, addressed with improved checks in a record-setting wave of Apple patches. An app installed on an affected device may be able to access sensitive user data beyond what its permissions should allow, meaning exploitation requires the victim to first install a malicious or compromised app (e.g., via App Store, sideloading, or enterprise distribution) rather than a remote network vector. Successful abuse gives the attacker's app unauthorized access to sensitive user data, a privacy/confidentiality breach rather than code execution. Affected users are those running iOS and iPadOS prior to the fixes in 26.7 and 27, macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate prior to 27, tvOS prior to 27, and visionOS prior to 27. There is no known in-the-wild exploitation, no public PoC, and the CVE is not on CISA's KEV list, though CVSS has not yet been scored and details may evolve.

Do: Patch promptly: update iPhones and iPads to iOS/iPadOS 26.7 or 27, Macs to macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, Apple TVs to tvOS 27, and Vision Pro headsets to visionOS 27, with MDM/IT fleets pushing these updates organization-wide. Because exploitation requires a malicious app on the device, audit installed apps, remove unfamiliar or unnecessary ones, and review app permission grants for suspicious data access. Watch for follow-up Apple advisories or a CVSS score, since this flaw landed in a record-setting patch wave and severity details may still be refined.

CVE-2026-65409 is a type confusion vulnerability (CWE-843) caused by improper memory handling in Apple's operating system frameworks, fixed with improved memory management. It is triggered when a locally installed malicious app interacts with the vulnerable code, requiring user interaction to execute (per the CVSS vector: local attack vector, no privileges required, user interaction required). Successful exploitation results only in a denial of service — an app may be able to crash the affected process or device — with no impact on confidentiality or integrity. The flaw affects a broad range of Apple platforms, including iOS, iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS, and was addressed in a record-setting batch of Apple patches. No public proof-of-concept exists and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation.

Do: Patch affected devices to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27, prioritizing devices that sideload or freely install third-party apps. Because exploitation requires a local app plus user interaction and only affects availability, this is a lower-priority patch than actively exploited flaws, but it should still roll into standard update cycles via MDM or automatic updates. Restrict app installation to the App Store and review any enterprise- or developer-signed apps deployed to managed fleets.

This is a denial-of-service flaw spanning Apple's operating systems: a locally installed app may be able to cause unexpected system termination (a device crash or forced reboot), which Apple addressed by adding improved validation checks. It is triggered by running a malicious or misbehaving app on the device, which abuses the missing checks to bring down the OS; there is no indication of remote triggering, code execution, or data exposure. The impact an attacker gains is purely availability — the ability to crash or repeatedly terminate a victim's device. Affected users include those on iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro devices running OS builds older than the fix releases (iOS/iPadOS 26.7 and 27, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). There is no public PoC, the CVE is absent from CISA's KEV catalog, and no exploitation in the wild is known; the patch shipped amid a record-setting batch of Apple security fixes.

Do: Deploy the fixed builds across the fleet: iOS/iPadOS 26.7 or 27, macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; enabling automatic updates will cover most consumer and BYOD devices. Because exploitation requires a malicious app already present on the device, this is lower urgency than remotely exploitable bugs — standard controls such as App Store-only installation and MDM app allow-listing substantially limit the attack path. Monitor for the pending CVSS score and any crash-report patterns suggesting abuse of the termination path.