# Apple Ships 273-CVE Coordinated Security Update Across iOS 27, macOS, watchOS, tvOS, visionOS, Safari, and Xcode — Bundles a Previously KEV-Listed Pre-Auth Screen Sharing RCE

> On 2026-09-14 Apple shipped a coordinated 273-CVE security update spanning iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27, including root-privilege bugs in CUPS and autofs, a kernel-privilege race condition in AVEVideoEncoder, and a CoreMedia arbitrary-code-execution flaw. The same macOS Golden Gate 27 advisory also carries CVE-2026-65400, a Screen Sharing Server authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog on 2026-08-18 — contradicting the surface read that none of the 273 CVEs have been exploited in the wild.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2522
- **ID:** TL-2026-2522
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65414, CVE-2026-84607, CVE-2026-64752, CVE-2026-65395, CVE-2026-84568, CVE-2026-43692, CVE-2026-65400, CVE-2026-86898, CVE-2026-64753, CVE-2026-65393, CVE-2026-43698, CVE-2026-43691, CVE-2026-64790, CVE-2026-43689, CVE-2026-86917, CVE-2026-84631, CVE-2026-84505, CVE-2026-65362, CVE-2026-86876, CVE-2026-65344, CVE-2026-84560, CVE-2026-43760

## Description

Apple's September 14, 2026 release is a large, coordinated cross-platform patch cycle: 1,038 product-level CVE listings collapse to 273 unique CVEs across iOS/iPadOS 27 (and the 26.7 branch), macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27. The highest-impact entries are pre-authentication or low-complexity remote issues: CVE-2026-65414 (Bluetooth, CVSS 9.8, CWE-787 out-of-bounds write, remote attacker can crash or achieve arbitrary code execution with no authentication or user interaction); a trio of CUPS root-privilege bugs (CVE-2026-43698, CVE-2026-43691, CVE-2026-43692 CVSS 8.8/CWE-20, CVE-2026-64790) credited to Nosebeard Labs and NVIDIA AI Red Team; an autofs path-traversal flaw (CVE-2026-84568, CVSS 7.8/CWE-22) letting an attacker-controlled network directory server execute code as root; a CoreMedia memory-corruption bug (CVE-2026-64752, CWE-787) triggering arbitrary code execution when a crafted image/video is processed; and an AVEVideoEncoder race condition (CVE-2026-84607, CVSS 7.8/CWE-362) letting a sandboxed app gain kernel-level code execution.

The most consequential finding from source verification is that CVE-2026-65400 (macOS Screen Sharing Server improper authentication, CVSS 9.8, CWE-287, credited to Alfredo Pesoli/Bynar.io) is not a net-new September disclosure: NVD lists its actual publish date as 2026-08-06, when Apple first patched it in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The bug is a break in the Screen Sharing daemon's Secure Remote Password (SRP) handshake — a frame-length validator erroneously returns a stale success status, letting sessions proceed as 'authenticated' without any credential and without TLS-grade protection. Per Huntress's technical writeup, the flaw was uncovered incrementally: Apple's 2026-07-27 patch for a related post-auth confused-deputy bug (CVE-2026-43760, also Bynar.io) inadvertently exposed the pre-auth path; Pedro Vilaça published a read-only PoC on 2026-07-29, and independent researcher Bl4sty turned it into a full read/write root RCE framework by 2026-08-02, abusing the `SSFileCopySender` helper's `kTCCServiceSystemPolicyAllFiles` entitlement to bypass TCC and read/write arbitrary files as root. CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog on 2026-08-18 with a due date of 2026-08-21 under BOD 26-04, confirming in-the-wild exploitation. Because macOS Golden Gate 27 is a new major OS baseline, Apple's September 14 advisory (support.apple.com/en-us/149035) re-lists the same CVE-2026-65400 fix as carried forward into the new release — meaning this 'no CVE in this batch was exploited' narrative from the trade-press coverage is accurate only for the September-dated entries themselves, not for the full CVE list the advisory enumerates.

Outside of Screen Sharing, no other CVE in this release currently appears in the CISA KEV catalog (verified for CVE-2026-43692, CVE-2026-84568, CVE-2026-64752, CVE-2026-65414, and CVE-2026-43760), and Apple's advisories do not claim active exploitation for the remaining 272 entries. The bulk of the disclosures were made responsibly through Apple's bug-bounty and research-partner channels, with heavy representation from Nosebeard Labs (Andreas Jaegersberger, Ro Achterberg — CUPS, autofs, Bluetooth, and kernel root-privilege findings), STAR Labs SG (multiple XNU kernel memory-disclosure/corruption bugs), Google Project Zero (ImageIO memory corruption, CVE-2026-65395), and Calif.io/Anthropic Research (AVEVideoEncoder and Foundation denial-of-service findings).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1543.004 Launch Daemon
- T1546.004 Unix Shell Configuration Modification
- T1555.001 Keychain
- T1082 System Information Discovery
- T1005 Data from Local System
- T1499.004 Application or System Exploitation

## Sources

- [Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices](https://cybersecuritynews.com/apple-security-update-273-vulnerabilities/)
- [Apple security releases](https://support.apple.com/en-us/100100)
- [About the security content of iOS 27 and iPadOS 27](https://support.apple.com/en-us/149034)
- [About the security content of macOS Golden Gate 27](https://support.apple.com/en-us/149035)
- [Here's every security fix included in iOS 27 and iPadOS 27](https://9to5mac.com/2026/09/14/heres-every-security-fix-included-in-ios-27-and-ipados-27/)
- [Known Exploited Vulnerabilities Catalog — CVE-2026-65400](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400)
- [From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS](https://www.huntress.com/blog/macos-screen-sharing-rce-patched)
- [NVD - CVE-2026-65400](https://nvd.nist.gov/vuln/detail/CVE-2026-65400)
- [NVD - CVE-2026-43692](https://nvd.nist.gov/vuln/detail/CVE-2026-43692)
- [NVD - CVE-2026-84568](https://nvd.nist.gov/vuln/detail/CVE-2026-84568)
- [NVD - CVE-2026-65414](https://nvd.nist.gov/vuln/detail/CVE-2026-65414)
- [NVD - CVE-2026-64752](https://nvd.nist.gov/vuln/detail/CVE-2026-64752)
- [NVD - CVE-2026-84607](https://nvd.nist.gov/vuln/detail/CVE-2026-84607)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2522