The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
- CVE-2026-65400 (CVSS 9.8) allows network authentication to Screen Sharing without credentials; flagged KEV.
- CVE-2026-65414 (CVSS 9.8) enables unexpected app termination or arbitrary code execution via Bluetooth.
- WebKit and WebRTC memory corruption flaws (CVSS 8.8) allow code execution via crafted web content.
- Malicious NFS, SMB, and WebDAV servers can trigger kernel memory corruption or code execution.
- Multiple sandbox escapes and root privilege escalation bugs affect core system components.
- CVEs
- CVE-2026-65400CVE-2026-65414CVE-2026-43692CVE-2026-65346CVE-2026-43686CVE-2026-65374CVE-2026-43715CVE-2026-43794CVE-2026-65390CVE-2026-65391CVE-2026-43760CVE-2026-84581CVE-2026-84535CVE-2026-84516CVE-2026-65415CVE-2026-84568CVE-2026-84607CVE-2026-84631CVE-2026-43786CVE-2026-84575CVE-2026-43691CVE-2026-43698CVE-2026-84505CVE-2026-65362CVE-2026-64758CVE-2026-43684CVE-2026-43689CVE-2026-86917CVE-2026-64712CVE-2026-84515
- Vendors
- Apple
- Organizations
- Zero Day InitiativeCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65414 | Out-of-Bounds Write in Apple iOS, iPadOS, macOS Enables Remote Code Execution | 9.8 group max | — | ||
| CVE-2026-65374 | Memory Corruption RCE via Malicious WebDAV Server in Apple macOS | 8.8 group max | <1% | PoC | |
CVE-2026-43760+1 related CVE | An access issue was addressed with improved access restrictions | 8.6 group max | <1% | ||
| CVE-2026-43715 | A use-after-free issue was addressed with improved memory management | 8.8 | <1% | ||
| CVE-2026-43794 | Memory Corruption in Apple Safari and OS Web Content Handling Across iOS, iPadOS, macOS | 8.8 | <1% | ||
| CVE-2026-64758 | The issue was addressed with improved bounds checks | 7.8 | <1% | ||
| CVE-2026-65346 | Integer Overflow in Apple Image Processing Allows Arbitrary Code Execution | 8.8 | <1% | ||
CVE-2026-65390+1 related CVE | Integer Overflow in Apple WebKit/Safari Allows Memory Corruption from Malicious Web Content | 8.8 | — | ||
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 18% | KEVPoC | KEV |
From the original article
16 min read at thezdi.com
Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs. For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.
By Dustin Childs · thezdi.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.