On September 14, 2026 Apple issued one of its most sweeping security updates in recent memory, addressing 273 distinct vulnerabilities spanning nearly its entire product line. That includes recent and legacy versions of iPhones, iPads, Macs, Apple Watches, Apple TV, the Vision Pro headset, Safari browser, and Xcode. Models running iOS, iPadOS, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27 as well as Safari 27 and Xcode 27 were patched, along with earlier builds like iOS/iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8.
The headline number—273—is not just a tally of every listed issue. Apple’s advisories include over 1,000 product-level CVE mentions due to identical flaws affecting common frameworks being counted multiple times across systems. After deduplicating, there are 273 unique vulnerabilities. macOS Golden Gate 27 is the most impacted release with 210 CVE entries behind it, followed by Sequoia 15.8 with 154 and Tahoe 26.7 with 153.
Vulnerabilities: What’s Included
Deep security holes were closed across several fronts. A dangerous out-of-bounds write in Bluetooth (CVE-2026-65414) could have allowed remote attackers to crash apps or run arbitrary code; a race condition in AVEVideoEncoder (CVE-2026-84607) potentially let sandboxed apps gain kernel privileges. From image parsing to memory handling, issues in CoreMedia (CVE-2026-64752) and ImageIO (CVE-2026-65395) exposed risks like arbitrary code execution and memory corruption.
Frameworks that handle fonts (FontParser, CoreText), graphics (CoreUI, SceneKit, RealityKit), model rendering (Model I/O), disks, and archives saw a buffet of fixes for buffer overflows, integer errors, unsafe parsing rules, and crashes. On macOS, several weaknesses enabling privilege escalation and security bypass were also closed, especially in autofs (CVE-2026-84568) and CUPS (CVE-2026-43692). Apple further strengthened protections around Gatekeeper, sandboxing, file quarantine, TCC privacy, and file systems like APFS, HFS, and exFAT.
Privacy & Web Components Under the Microscope
Privacy-related flaws were addressed in subsystems like Keychain, CloudKit, Sign in with Apple, Spotlight, Photos, Siri, Shortcuts, and NetworkExtension. Vulnerabilities that could reveal device identifiers, installed apps, or location data—or allow access to sensitive files or system areas—were patched. Web-facing components received updates too: WebKit fixes for memory corruption, use-after-free bugs, cross-site scripting (XSS) issues, and information disclosure vulnerabilities were all part of the release.
Safari 27 tackled six CVEs—including one that could enable universal XSS via crafted webarchive files (CVE-2026-86898), and another related to web content information leaks (CVE-2026-64753). Xcode 27 also saw a permissions hole plugged (CVE-2026-65393) that otherwise could expose private data.
Apple’s advisory notes there’s no confirmation any of the 273 vulnerabilities have been actively exploited so far. However, getting detailed CVE information out in public could accelerate the creation of exploits if patches aren’t applied promptly.
Where You Should Start With the Update
Every user and organization should prioritize installing the newest compatible software via Software Update without delay. Enterprises must especially focus on devices that face the internet, handle untrusted content or media, utilize Bluetooth heavily, serve as shared workstations, or connect to external file servers.
Security teams should verify that all devices are updated, put critical apps through testing, and monitor for unusual crashes, privilege escalations, or privacy settings changes. Network behavior around file services and remote access tools should also be reviewed once the patches are in place.
This coordinated multi-platform patching event reflects how Apple’s shared frameworks create shared risk: a single flaw can ripple across iPhones, Macs, watches, TVs, and spatial computing devices alike. It underscores the urgency for users and organizations alike to view their Apple ecosystem holistically when deploying security updates—one weak link can compromise them all.
