The vulnpocalypse rains iBugs down on Apple with record-setting number of patches
Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.
Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.
- 260+ CVEs patched is Apple's largest-ever single patch cycle
- CVE-2026-43692 in CUPS enables remote code execution via printer interface
- CVE-2026-43689 allows iOS apps to gain root privileges
- Multiple SMB and WebDAV flaws could leak kernel memory or execute code
- AI-assisted discovery credited for ten CVEs including by Nvidia AI Red Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65374 | Memory Corruption RCE via Malicious WebDAV Server in Apple macOS | 8.8 group max | <1% | PoC | |
CVE-2026-43689+3 related CVEs | Apple Permissions Flaw Lets Malicious Apps Gain Root on iOS, iPadOS, macOS, visionOS | 7.8 group max | — |
From the original article
3 min read at theregister.comApple has addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino's history. While this CVE count is hardly notable compared to some vendors - hello, Microsoft’s record-breaking 974 bugs disclosed earlier this month - it does set a company record for Apple.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.