Apple Ships 273-CVE Coordinated Security Update Across iOS 27, macOS, watchOS, tvOS, visionOS, Safari, and Xcode — Bundles a Previously KEV-Listed Pre-Auth Screen Sharing RCE

Apple Ships 273-CVE Coordinated Security Update Across iOS (TL-2026-2522) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-15. It has no confirmed attribution, affects Apple iOS / iPadOS, references 22 CVEs (CVE-2026-65414, CVE-2026-84607, CVE-2026-64752), maps to 8 MITRE ATT&CK techniques (T1005, T1082, T1190), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-2522

Threat ID
TL-2026-2522
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-09-15
Last reviewed
2026-09-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, enterprise-it, technology, all-sectors-with-apple-devices
Target regions
Global, North America
Detection rules
9
Indicators of compromise
16

Malware and tooling in Apple Ships 273-CVE Coordinated Security Update Across iOS

Malware and tooling: VNC

On 2026-09-14 Apple shipped a coordinated 273-CVE security update spanning iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27, including root-privilege bugs in CUPS and autofs, a kernel-privilege race condition in AVEVideoEncoder, and a CoreMedia arbitrary-code-execution flaw. The same macOS Golden Gate 27 advisory also carries CVE-2026-65400, a Screen Sharing Server authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog on 2026-08-18 — contradicting the surface read that none of the 273 CVEs have been exploited in the wild.

How Apple Ships 273-CVE Coordinated Security Update Across iOS works

Apple's September 14, 2026 release is a large, coordinated cross-platform patch cycle: 1,038 product-level CVE listings collapse to 273 unique CVEs across iOS/iPadOS 27 (and the 26.7 branch), macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27. The highest-impact entries are pre-authentication or low-complexity remote issues: CVE-2026-65414 (Bluetooth, CVSS 9.8, CWE-787 out-of-bounds write, remote attacker can crash or achieve arbitrary code execution with no authentication or user interaction); a trio of CUPS root-privilege bugs (CVE-2026-43698, CVE-2026-43691, CVE-2026-43692 CVSS 8.8/CWE-20, CVE-2026-64790) credited to Nosebeard Labs and NVIDIA AI Red Team; an autofs path-traversal flaw (CVE-2026-84568, CVSS 7.8/CWE-22) letting an attacker-controlled network directory server execute code as root; a CoreMedia memory-corruption bug (CVE-2026-64752, CWE-787) triggering arbitrary code execution when a crafted image/video is processed; and an AVEVideoEncoder race condition (CVE-2026-84607, CVSS 7.8/CWE-362) letting a sandboxed app gain kernel-level code execution.

The most consequential finding from source verification is that CVE-2026-65400 (macOS Screen Sharing Server improper authentication, CVSS 9.8, CWE-287, credited to Alfredo Pesoli/Bynar.io) is not a net-new September disclosure: NVD lists its actual publish date as 2026-08-06, when Apple first patched it in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The bug is a break in the Screen Sharing daemon's Secure Remote Password (SRP) handshake — a frame-length validator erroneously returns a stale success status, letting sessions proceed as 'authenticated' without any credential and without TLS-grade protection. Per Huntress's technical writeup, the flaw was uncovered incrementally: Apple's 2026-07-27 patch for a related post-auth confused-deputy bug (CVE-2026-43760, also Bynar.io) inadvertently exposed the pre-auth path; Pedro Vilaça published a read-only PoC on 2026-07-29, and independent researcher Bl4sty turned it into a full read/write root RCE framework by 2026-08-02, abusing the `SSFileCopySender` helper's `kTCCServiceSystemPolicyAllFiles` entitlement to bypass TCC and read/write arbitrary files as root. CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog on 2026-08-18 with a due date of 2026-08-21 under BOD 26-04, confirming in-the-wild exploitation. Because macOS Golden Gate 27 is a new major OS baseline, Apple's September 14 advisory (support.apple.com/en-us/149035) re-lists the same CVE-2026-65400 fix as carried forward into the new release — meaning this 'no CVE in this batch was exploited' narrative from the trade-press coverage is accurate only for the September-dated entries themselves, not for the full CVE list the advisory enumerates.

Outside of Screen Sharing, no other CVE in this release currently appears in the CISA KEV catalog (verified for CVE-2026-43692, CVE-2026-84568, CVE-2026-64752, CVE-2026-65414, and CVE-2026-43760), and Apple's advisories do not claim active exploitation for the remaining 272 entries. The bulk of the disclosures were made responsibly through Apple's bug-bounty and research-partner channels, with heavy representation from Nosebeard Labs (Andreas Jaegersberger, Ro Achterberg — CUPS, autofs, Bluetooth, and kernel root-privilege findings), STAR Labs SG (multiple XNU kernel memory-disclosure/corruption bugs), Google Project Zero (ImageIO memory corruption, CVE-2026-65395), and Calif.io/Anthropic Research (AVEVideoEncoder and Foundation denial-of-service findings).

MITRE ATT&CK techniques used in TL-2026-2522

Collection

T1005 Data from Local System

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Impact

T1499.004 Application or System Exploitation

Persistence

T1543.004 Launch Daemon; T1546.004 Unix Shell Configuration Modification

Credential Access

T1555.001 Keychain

Affected products and versions in Apple Ships 273-CVE Coordinated Security Update Across iOS

  • Apple — iOS / iPadOS
    Vulnerable versions: iOS/iPadOS prior to 27; iOS/iPadOS prior to 26.7
    Fixed in: iOS 27 / iPadOS 27; iOS 26.7 / iPadOS 26.7
  • Apple — macOS
    Vulnerable versions: macOS Sequoia prior to 15.8; macOS Tahoe prior to 26.7; macOS Sonoma prior to 14.8.9 (CVE-2026-65400); macOS Sequoia prior to 15.7.9 (CVE-2026-65400); macOS Tahoe prior to 26.6.1 (CVE-2026-65400)
    Fixed in: macOS Golden Gate 27; macOS Tahoe 26.7; macOS Sequoia 15.8
  • Apple — watchOS
    Vulnerable versions: watchOS prior to 27
    Fixed in: watchOS 27
  • Apple — tvOS
    Vulnerable versions: tvOS prior to 27
    Fixed in: tvOS 27
  • Apple — visionOS
    Vulnerable versions: visionOS prior to 27
    Fixed in: visionOS 27
  • Apple — Safari
    Vulnerable versions: Safari prior to 27
    Fixed in: Safari 27
  • Apple — Xcode
    Vulnerable versions: Xcode prior to 27
    Fixed in: Xcode 27

Remediation for Apple Ships 273-CVE Coordinated Security Update Across iOS

Patches

  • iOS 27 / iPadOS 27
  • iOS 26.7 / iPadOS 26.7
  • macOS Golden Gate 27
  • macOS Tahoe 26.7
  • macOS Sequoia 15.8
  • watchOS 27
  • tvOS 27
  • visionOS 27
  • Safari 27
  • Xcode 27

Immediate actions

  • Deploy Apple's 2026-09-14 security updates fleet-wide: iOS 27/iPadOS 27 (or 26.7 branch), macOS Golden Gate 27 (or macOS Tahoe 26.7 / macOS Sequoia 15.8), watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27
  • Independently confirm every Mac has at least macOS Sequoia 15.7.9, Sonoma 14.8.9, or Tahoe 26.6.1 — the CVE-2026-65400 fix predates this rollup by five weeks and is CISA KEV-listed with an already-passed 2026-08-21 BOD 26-04 due date
  • Disable Screen Sharing / VNC on any Mac that cannot be immediately patched; standard hardening (disabling accounts, rotating credentials) does not mitigate the pre-authentication CVE-2026-65400 exploit path
  • Restrict cupsd network exposure to trusted segments only pending confirmation of CVE-2026-43692/43698/43691/64790 patching
  • Audit autofs network directory server trust relationships for exposure to CVE-2026-84568

Workarounds

  • Disable Screen Sharing entirely where the CVE-2026-65400 patch cannot yet be applied
  • Restrict CUPS and autofs network reachability to trusted segments as an interim compensating control

Longer-term hardening

  • Enroll the macOS/iOS fleet in MDM-enforced automatic security updates to close the gap between KEV disclosure and rollout
  • Deploy EndpointSecurity-based monitoring for ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events with session_username=root and authentication_type=SRP but no valid credential
  • Alert on unauthorized LaunchDaemon creation and modification of shell startup files (e.g. ~/.zshenv) as post-exploitation persistence indicators
  • Track CISA KEV additions for Apple products directly rather than relying solely on vendor release-note framing, since a KEV-listed bug can be silently re-carried into a later cumulative advisory

CVEs associated with Apple Ships 273-CVE Coordinated Security Update Across iOS

  • CVE-2026-65414
  • CVE-2026-84607
  • CVE-2026-64752
  • CVE-2026-65395
  • CVE-2026-84568
  • CVE-2026-43692
  • CVE-2026-65400
  • CVE-2026-86898
  • CVE-2026-64753
  • CVE-2026-65393
  • CVE-2026-43698
  • CVE-2026-43691
  • CVE-2026-64790
  • CVE-2026-43689
  • CVE-2026-86917
  • CVE-2026-84631
  • CVE-2026-84505
  • CVE-2026-65362
  • CVE-2026-86876
  • CVE-2026-65344
  • CVE-2026-84560
  • CVE-2026-43760

Weaknesses (CWE) in Apple Ships 273-CVE Coordinated Security Update Across iOS

CWE-787, CWE-20, CWE-22, CWE-287, CWE-362

Timeline of Apple Ships 273-CVE Coordinated Security Update Across iOS

  • Apple patches CVE-2026-43760, a post-authentication confused-deputy flaw in macOS Screen Sharing Server, inadvertently exposing an adjacent pre-authentication code path.
  • Bynar.io publishes analysis of CVE-2026-43760; researcher Pedro Vilaça independently discloses a read-only proof-of-concept for the pre-authentication SRP bypass that becomes CVE-2026-65400.
  • Independent researcher Bl4sty reverses the read-only PoC into a full read/write root remote-code-execution exploitation framework for CVE-2026-65400.
  • Apple patches CVE-2026-65400 (macOS Screen Sharing Server SRP authentication bypass) in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1.
  • CISA adds CVE-2026-65400 to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation, with a BOD 26-04 remediation due date of 2026-08-21.
  • Cyber Security News and 9to5Mac publish detailed breakdowns of the release, with 9to5Mac citing 120+ fixes for iOS 27/iPadOS 27 alone.
  • Apple ships a coordinated 273-unique-CVE security update across iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27; the macOS Golden Gate 27 advisory re-lists CVE-2026-65400 as part of the new baseline.
  • Threat added to the TL-Intel backlog from Cyber Security News coverage of the 273-CVE Apple security update.

Sources cited for Apple Ships 273-CVE Coordinated Security Update Across iOS

More in vulnerability

Detection coverage for TL-2026-2522

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2522 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats