Threat reportVulnerabilityTL-2026-2522
Apple Ships 273-CVE Coordinated Security Update Across iOS 27, macOS, watchOS, tvOS, visionOS, Safari, and Xcode — Bundles a Previously KEV-Listed Pre-Auth Screen Sharing RCE
On 2026-09-14 Apple shipped a coordinated 273-CVE security update spanning iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27, including root-privilege bugs in CUPS and autofs, a kernel-privilege race condition in AVEVideoEncoder, and a CoreMedia arbitrary-code-execution flaw.
Key facts for Apple 273-CVE September update
Detection coverage for Apple 273-CVE September update
As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2522 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Post-Exploitation Persistence Chain Following Screen Sharing RCE — TCC Bypass, LaunchDaemon, and zshenv
Correlates the documented CVE-2026-65400 post-exploitation chain: the SSFileCopySender helper abusing its kTCCServiceSystemPolicyAllFiles entitlement to read/write root-owned files including Keychain data (TCC bypass), followed by creation of a new LaunchDaemon plist for reboot-persistent execution and/or modification of ~/.zshenv for shell-triggered persistence — the exact sequence documented in Huntress's technical writeup of the exploit chain.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1543.004, T1546.004, T1555.001, T1005, T1082
- Data sources: macos_endpointsecurity, jamf_protect_alerts, microsoft_defender_for_endpoint_mac, keychain_tcc_audit
- Severity: high
- Confidence: high
Splunk SPL
index=endpoint_security sourcetype="mac:endpointsecurity:notify"
(event_type="ES_EVENT_TYPE_NOTIFY_EXEC" process_path="*SSFileCopySender*" args="*Keychains*") OR (event_type="ES_EVENT_TYPE_NOTIFY_EXEC" process_path="*SSFileCopySender*" args="*TCC.db*")
OR (event_type="ES_EVENT_TYPE_NOTIFY_CREATE" file_path="/Library/LaunchDaemons/*.plist")
OR (event_type="ES_EVENT_TYPE_NOTIFY_WRITE" file_path="*/.zshenv")
| eval indicator=case(
match(event_type,"EXEC") AND match(process_path,"SSFileCopySender"), "tcc_bypass_keychain_read",
match(event_type,"CREATE") AND match(file_path,"LaunchDaemons"), "launchdaemon_persistence",
match(event_type,"WRITE") AND match(file_path,"zshenv"), "shell_startup_persistence")
| stats count values(indicator) as indicators dc(indicator) as indicator_types min(_time) as first_seen max(_time) as last_seen by host
| where indicator_types >= 2
| sort - indicator_typesMicrosoft KQL
let tccBypass = DeviceProcessEvents
| where Timestamp > ago(24h) and DeviceOS == "MacOS"
| where FolderPath has "SSFileCopySender" and ProcessCommandLine has_any ("Keychains", "TCC.db")
| project DeviceId, Timestamp, Indicator = "tcc_bypass_keychain_read";
let launchDaemon = DeviceFileEvents
| where Timestamp > ago(24h) and DeviceOS == "MacOS"
| where FolderPath startswith "/Library/LaunchDaemons/" and FileName endswith ".plist" and ActionType == "FileCreated"
| project DeviceId, Timestamp, Indicator = "launchdaemon_persistence";
let zshenvWrite = DeviceFileEvents
| where Timestamp > ago(24h) and DeviceOS == "MacOS"
| where FolderPath has_cs ".zshenv" and ActionType in ("FileModified", "FileCreated")
| project DeviceId, Timestamp, Indicator = "shell_startup_persistence";
union tccBypass, launchDaemon, zshenvWrite
| summarize Indicators = make_set(Indicator), IndicatorCount = dcount(Indicator), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId
| where IndicatorCount >= 2
| order by IndicatorCount descSigma
title: macOS Post-Exploitation Persistence Chain Following Screen Sharing RCE (CVE-2026-65400)
id: f2b3c4d5-2222-4b3c-9d4e-0a1b2c3d4e5f
status: experimental
description: Detects the SSFileCopySender TCC-bypass file read/write, LaunchDaemon creation, and ~/.zshenv modification persistence chain documented following exploitation of the macOS Screen Sharing pre-auth RCE (CVE-2026-65400).
references:
- https://www.huntress.com/blog/macos-screen-sharing-rce-patched
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
- attack.persistence
- attack.t1543.004
- attack.t1546.004
- attack.credential-access
- attack.t1555.001
- attack.collection
- attack.t1005
- cve.2026.65400
logsource:
product: macos
service: endpointsecurity
detection:
tcc_bypass:
event_type: 'ES_EVENT_TYPE_NOTIFY_EXEC'
process_path|contains: 'SSFileCopySender'
args|contains:
- 'Keychains'
- 'TCC.db'
launchdaemon:
event_type: 'ES_EVENT_TYPE_NOTIFY_CREATE'
file_path|contains: '/Library/LaunchDaemons/'
file_path|endswith: '.plist'
zshenv:
event_type: 'ES_EVENT_TYPE_NOTIFY_WRITE'
file_path|endswith: '/.zshenv'
condition: tcc_bypass or launchdaemon or zshenv
falsepositives:
- Legitimate MDM/RMM tooling creating LaunchDaemons during authorized software deployment
- Developers manually editing ~/.zshenv for local shell configuration
level: highKnown false positives:
- Legitimate MDM/RMM software deployment creating a new LaunchDaemon, or a developer manually editing ~/.zshenv for local shell configuration
Tuning notes: Raise confidence by requiring indicator_types >= 2 within a tight time window (e.g. 15 minutes) rather than alerting on any single indicator alone; allow-list known MDM package identifiers and signed LaunchDaemon labels before enabling for a production SOC queue.
- Unauthenticated Root macOS Screen Sharing Session — CVE-2026-65400 SRP Bypass Exploitation · unlock with TL Creds
- Post-Exploitation Persistence Chain Following Screen Sharing RCE — TCC Bypass, LaunchDaemon, and zshenv · unlock with TL Creds
- Fleet-Wide Remote Service Exploitation — [indicator] / CUPS / Bluetooth (Apple Sept 2026 CVE Batch) · unlock with TL Creds
- Unauthenticated Root macOS Screen Sharing Session — CVE-2026-65400 SRP Bypass Exploitation · unlock with TL Creds
- Post-Exploitation Persistence Chain Following Screen Sharing RCE — TCC Bypass, LaunchDaemon, and zshenv · unlock with TL Creds
- Fleet-Wide Remote Service Exploitation — [indicator] / CUPS / Bluetooth (Apple Sept 2026 CVE Batch) · unlock with TL Creds
- Unauthenticated Root macOS Screen Sharing Session — CVE-2026-65400 SRP Bypass Exploitation · unlock with TL Creds
- Fleet-Wide Remote Service Exploitation — [indicator] / CUPS / Bluetooth (Apple Sept 2026 CVE Batch) · unlock with TL Creds
Indicators of compromise for Apple 273-CVE September update
As of 2026-09-15, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2522.
How Apple 273-CVE September update works
The same macOS Golden Gate 27 advisory also carries CVE-2026-65400, a Screen Sharing Server authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog on 2026-08-18 — contradicting the surface read that none of the 273 CVEs have been exploited in the wild.
Apple's September 14, 2026 release is a large, coordinated cross-platform patch cycle: 1,038 product-level CVE listings collapse to 273 unique CVEs across iOS/iPadOS 27 (and the 26.7 branch), macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27. The highest-impact entries are pre-authentication or low-complexity remote issues: CVE-2026-65414 (Bluetooth, CVSS 9.8, CWE-787 out-of-bounds write, remote attacker can crash or achieve arbitrary code execution with no authentication or user interaction); a trio of CUPS root-privilege bugs (CVE-2026-43698, CVE-2026-43691, CVE-2026-43692 CVSS 8.8/CWE-20, CVE-2026-64790) credited to Nosebeard Labs and NVIDIA AI Red Team; an autofs path-traversal flaw (CVE-2026-84568, CVSS 7.8/CWE-22) letting an attacker-controlled network directory server execute code as root; a CoreMedia memory-corruption bug (CVE-2026-64752, CWE-787) triggering arbitrary code execution when a crafted image/video is processed; and an AVEVideoEncoder race condition (CVE-2026-84607, CVSS 7.8/CWE-362) letting a sandboxed app gain kernel-level code execution.
The most consequential finding from source verification is that CVE-2026-65400 (macOS Screen Sharing Server improper authentication, CVSS 9.8, CWE-287, credited to Alfredo Pesoli/Bynar.io) is not a net-new September disclosure: NVD lists its actual publish date as 2026-08-06, when Apple first patched it in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The bug is a break in the Screen Sharing daemon's Secure Remote Password (SRP) handshake — a frame-length validator erroneously returns a stale success status, letting sessions proceed as 'authenticated' without any credential and without TLS-grade protection. Per Huntress's technical writeup, the flaw was uncovered incrementally: Apple's 2026-07-27 patch for a related post-auth confused-deputy bug (CVE-2026-43760, also Bynar.io) inadvertently exposed the pre-auth path; Pedro Vilaça published a read-only PoC on 2026-07-29, and independent researcher Bl4sty turned it into a full read/write root RCE framework by 2026-08-02, abusing the `SSFileCopySender` helper's `kTCCServiceSystemPolicyAllFiles` entitlement to bypass TCC and read/write arbitrary files as root. CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog on 2026-08-18 with a due date of 2026-08-21 under BOD 26-04, confirming in-the-wild exploitation. Because macOS Golden Gate 27 is a new major OS baseline, Apple's September 14 advisory (support.apple.com/en-us/149035) re-lists the same CVE-2026-65400 fix as carried forward into the new release — meaning this 'no CVE in this batch was exploited' narrative from the trade-press coverage is accurate only for the September-dated entries themselves, not for the full CVE list the advisory enumerates.
Outside of Screen Sharing, no other CVE in this release currently appears in the CISA KEV catalog (verified for CVE-2026-43692, CVE-2026-84568, CVE-2026-64752, CVE-2026-65414, and CVE-2026-43760), and Apple's advisories do not claim active exploitation for the remaining 272 entries. The bulk of the disclosures were made responsibly through Apple's bug-bounty and research-partner channels, with heavy representation from Nosebeard Labs (Andreas Jaegersberger, Ro Achterberg — CUPS, autofs, Bluetooth, and kernel root-privilege findings), STAR Labs SG (multiple XNU kernel memory-disclosure/corruption bugs), Google Project Zero (ImageIO memory corruption, CVE-2026-65395), and Calif.io/Anthropic Research (AVEVideoEncoder and Foundation denial-of-service findings).
MITRE ATT&CK techniques by tactic:
Collection
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Impact
T1499.004 Application or System Exploitation
Persistence
T1543.004 Launch Daemon; T1546.004 Unix Shell Configuration Modification
Credential Access
Remediation for Apple 273-CVE September update
Patches
- iOS 27 / iPadOS 27
- iOS 26.7 / iPadOS 26.7
- macOS Golden Gate 27
- macOS Tahoe 26.7
- macOS Sequoia 15.8
- watchOS 27
- tvOS 27
- visionOS 27
- Safari 27
- Xcode 27
Immediate actions
- Deploy Apple's 2026-09-14 security updates fleet-wide: iOS 27/iPadOS 27 (or 26.7 branch), macOS Golden Gate 27 (or macOS Tahoe 26.7 / macOS Sequoia 15.8), watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27
- Independently confirm every Mac has at least macOS Sequoia 15.7.9, Sonoma 14.8.9, or Tahoe 26.6.1 — the CVE-2026-65400 fix predates this rollup by five weeks and is CISA KEV-listed with an already-passed 2026-08-21 BOD 26-04 due date
- Disable Screen Sharing / VNC on any Mac that cannot be immediately patched; standard hardening (disabling accounts, rotating credentials) does not mitigate the pre-authentication CVE-2026-65400 exploit path
- Restrict cupsd network exposure to trusted segments only pending confirmation of CVE-2026-43692/43698/43691/64790 patching
- Audit autofs network directory server trust relationships for exposure to CVE-2026-84568
Workarounds
- Disable Screen Sharing entirely where the CVE-2026-65400 patch cannot yet be applied
- Restrict CUPS and autofs network reachability to trusted segments as an interim compensating control
Longer-term hardening
- Enroll the macOS/iOS fleet in MDM-enforced automatic security updates to close the gap between KEV disclosure and rollout
- Deploy EndpointSecurity-based monitoring for ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events with session_username=root and authentication_type=SRP but no valid credential
- Alert on unauthorized LaunchDaemon creation and modification of shell startup files (e.g. ~/.zshenv) as post-exploitation persistence indicators
- Track CISA KEV additions for Apple products directly rather than relying solely on vendor release-note framing, since a KEV-listed bug can be silently re-carried into a later cumulative advisory
Affected and fixed versions
- Apple — iOS / iPadOS
Vulnerable versions: iOS/iPadOS prior to 27; iOS/iPadOS prior to 26.7
Fixed in: iOS 27 / iPadOS 27; iOS 26.7 / iPadOS 26.7 - Apple — macOS
Vulnerable versions: macOS Sequoia prior to 15.8; macOS Tahoe prior to 26.7; macOS Sonoma prior to 14.8.9 (CVE-2026-65400); macOS Sequoia prior to 15.7.9 (CVE-2026-65400); macOS Tahoe prior to 26.6.1 (CVE-2026-65400)
Fixed in: macOS Golden Gate 27; macOS Tahoe 26.7; macOS Sequoia 15.8 - Apple — watchOS
Vulnerable versions: watchOS prior to 27
Fixed in: watchOS 27 - Apple — tvOS
Vulnerable versions: tvOS prior to 27
Fixed in: tvOS 27 - Apple — visionOS
Vulnerable versions: visionOS prior to 27
Fixed in: visionOS 27 - Apple — Safari
Vulnerable versions: Safari prior to 27
Fixed in: Safari 27 - Apple — Xcode
Vulnerable versions: Xcode prior to 27
Fixed in: Xcode 27
Timeline of Apple 273-CVE September update
- Apple patches CVE-2026-43760, a post-authentication confused-deputy flaw in macOS Screen Sharing Server, inadvertently exposing an adjacent pre-authentication code path.
- locked-ioc-13 publishes analysis of CVE-2026-43760; researcher Pedro Vilaça independently discloses a read-only proof-of-concept for the pre-authentication SRP bypass that becomes CVE-2026-65400.
- Independent researcher locked-ioc-16 reverses the read-only PoC into a full read/write root remote-code-execution exploitation framework for CVE-2026-65400.
- Apple patches CVE-2026-65400 (macOS Screen Sharing Server SRP authentication bypass) in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1.
- CISA adds CVE-2026-65400 to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation, with a BOD 26-04 remediation due date of 2026-08-21.
- Cyber Security News and 9to5Mac publish detailed breakdowns of the release, with 9to5Mac citing 120+ fixes for iOS 27/iPadOS 27 alone.
- Apple ships a coordinated 273-unique-CVE security update across iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27; the macOS Golden Gate 27 advisory re-lists CVE-2026-65400 as part of the new baseline.
- Threat added to the TL-Intel backlog from Cyber Security News coverage of the 273-CVE Apple security update.
Sources cited for Apple 273-CVE September update
- Apple security releases Apple · Advisory · 2026-09-14
- About the security content of iOS 27 and iPadOS 27 Apple · Advisory · 2026-09-14
- About the security content of macOS Golden Gate 27 Apple · Advisory · 2026-09-14
- Known Exploited Vulnerabilities Catalog — CVE-2026-65400 CISA · Government advisory · 2026-08-18
- NVD - CVE-2026-65400 NVD (NIST) · Advisory · 2026-08-06
- NVD - CVE-2026-43692 NVD (NIST) · Advisory · 2026-09-14
- NVD - CVE-2026-84568 NVD (NIST) · Advisory · 2026-09-14
- NVD - CVE-2026-65414 NVD (NIST) · Advisory · 2026-09-14
- NVD - CVE-2026-64752 NVD (NIST) · Advisory · 2026-09-14
- NVD - CVE-2026-84607 NVD (NIST) · Advisory · 2026-09-14
- From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS Huntress · Research · 2026-08-18
- Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices cybersecuritynews.com · News · 2026-09-15
- Here's every security fix included in iOS 27 and iPadOS 27 9to5mac.com · News · 2026-09-14
Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.
