Apple released a major coordinated security update on September 14, 2026, addressing 273 unique CVE vulnerabilities across iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode. The fixes were delivered through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27, Xcode 27, as well as security updates for iOS/iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8. Although Apple’s ten advisories contain 1,038 product-level CVE listings, overlapping vulnerabilities reduce this to 273 unique issues. macOS Golden Gate 27 received the largest coverage with 210 CVEs, followed by macOS Sequoia 15.8 with 154 and macOS Tahoe 26.7 with 153.

Several of the vulnerabilities could result in serious security impact, including arbitrary code execution, kernel-level code execution, crashes, memory corruption, and privilege escalation. CVE-2026-65414 affects Bluetooth and could allow a remote attacker to trigger an application crash or execute arbitrary code through an out-of-bounds write, while CVE-2026-84607 is a race condition in AVEVideoEncoder that could allow a sandboxed application to execute code with kernel privileges. Apple also addressed media-processing vulnerabilities including CVE-2026-64752 in CoreMedia and CVE-2026-65395 in ImageIO, along with additional flaws in FontParser, CoreText, CoreUI, SceneKit, RealityKit, Model I/O, and disk-image processing. On macOS, fixes also address privilege escalation and security-control bypasses, including CVE-2026-84568 in autofs, which could potentially allow code execution as root when an attacker controls a network directory server, and CVE-2026-43692 in CUPS, which could enable crashes or arbitrary code execution.

The update also strengthens several important security and privacy mechanisms, including Gatekeeper, sandbox enforcement, file quarantine, TCC privacy controls, SMB, WebDAV, APFS, HFS, exFAT, and disk-image handling. CVE-2026-65400 in the macOS Screen Sharing Server is particularly notable because an authentication flaw could allow a network attacker to access screen sharing without valid credentials. Apple also patched issues affecting Keychain, Sign in with Apple, CloudKit, NetworkExtension, Spotlight, Photos, Siri, and Shortcuts that could expose persistent identifiers, installed applications, sensitive files, protected system locations, privacy settings, or location information. Web-facing components received extensive attention as well, with WebKit fixes covering memory corruption, use-after-free, information disclosure, cross-site scripting, and crash vulnerabilities. Safari 27 fixes six CVEs, including CVE-2026-86898, which could enable universal cross-site scripting through a malicious webarchive, while CVE-2026-64753 could expose sensitive information during web-content processing; Xcode 27 also addresses CVE-2026-65393, involving permissions and sensitive-data exposure.

The scale of the rollout highlights the security impact of Apple’s shared software architecture, where vulnerabilities in common frameworks can affect multiple device families simultaneously. Apple’s advisories do not indicate that these 273 vulnerabilities were exploited in the wild, but public vulnerability details can increase attacker awareness and facilitate exploit development. Organizations should therefore prioritize patching internet-facing Macs, systems processing untrusted media or archives, Bluetooth-enabled devices, shared workstations, developer systems, and endpoints connecting to external file servers. Security teams should verify update deployment through MDM, test critical applications, and monitor for abnormal crashes, privilege escalation, unauthorized privacy changes, and suspicious network-service activity. Users and enterprises should install the latest compatible Apple security releases as soon as operationally possible to reduce exposure across the affected fleet.