Skip to content

Back to the catalog

The Apple Security Update Review for September 2026
zerodayinitiative.comarticle

The Apple Security Update Review for September 2026

Zero Day Initiative's monthly Apple patch review covers the September 2026 release (macOS 27/Sequoia 15.8/Tahoe 26.7, iOS/iPadOS 27 & 26.7, visionOS, watchOS, tvOS, Safari, Xcode), totaling 273 CVEs. It highlights CVE-2026-65400 (Screen Sharing Server authentication bypass, 9.8 CRITICAL, actively exploited per CISA KEV), CVE-2026-65414 (Bluetooth remote code execution, 9.8 CRITICAL, affecting all eight platforms), and CVE-2026-65346 (ImageIO arbitrary code execution via malicious image, 8.8 HIGH), plus a full CVE-by-component-by-platform table with CVSS scores where NVD/CISA-ADP has assigned them.

TL;DR ZDI's September 2026 Apple patch review: 273 CVEs, including an actively-exploited Screen Sharing auth-bypass (CVE-2026-65400) and a critical cross-platform Bluetooth RCE (CVE-2026-65414).
Open original ↗
Document

What it is

ZDI's September 2026 Apple review, but the reader-relevant content the summary omits is the severity-data caveat and the CVEs it hides. Of 273 CVEs, only 134 are scored; 139 are still TBD (NVD hasn't analyzed them). The published ranking — 2 CRITICAL, 46 HIGH, 84 MEDIUM, 2 LOW — reflects only the scored half, so "top three by CVSS" is not "top three by real impact."

The prioritization details the summary drops

CVE-2026-65400 (Screen Sharing Server, 9.8, KEV, exploited) was first patched August 6 and only relisted in v27 — macOS 27 / Tahoe 26.7 now carry the fix. If you patched in early August you may already be covered on Sequoia; the September relist is what closes it for the newer trains. Worth verifying rather than assuming this is net-new.

CVE-2026-65414 (Bluetooth, 9.8) — CISA tagged it automatable: yes, technical impact: total, no privileges or interaction, spanning all eight platforms. ZDI calls it the most likely next KEV entry. Treat as if exploitation is imminent.

Two arguably-worse bugs that don't appear in any ranking because they're unscored (TBD):

  • CVE-2026-84607 (AVEVideoEncoder) — sandboxed app → arbitrary code execution with kernel privileges. Per the table, affects all eight OS platforms (not Safari/Xcode).
  • CVE-2026-43790 (Kernel) — remote attacker causing kernel memory corruption; macOS 27 / Tahoe 26.7 / Sequoia 15.8.

ZDI states both are "arguably more severe by impact" than the #3 ImageIO bug but rank nowhere on current evidence. A CVSS-driven patch queue will de-prioritize them incorrectly.

Also at the top of the HIGH band: CVE-2026-43692 (CUPS, remote RCE) and CVE-2026-84568 (autofs, root RCE via a malicious network directory server) — both macOS-only (27/Tahoe/Sequoia).

What to do

Patch all listed trains. Do not rank by CVSS alone this cycle — the 139 TBD entries mean the score column is half-blank. Manually surface kernel/sandbox-escape and remote-RCE impacts (84607, 43790, 43692, 84568) even where severity reads TBD. Confirm 65400 is actually closed on each platform given its August-then-September relisting.

Caveats

The severity split is a snapshot as of Sept 16, 2026; scores will shift as NVD works through the backlog. ZDI's own ranking explicitly excludes unscored bugs, which is why the two kernel-impact CVEs are called out separately rather than ranked.

CVEs named here

  • CVE-2026-65400
  • CVE-2026-65414
  • CVE-2026-43692
  • CVE-2026-65346
  • CVE-2026-43686
  • CVE-2026-65374
  • CVE-2026-43715
  • CVE-2026-43794
  • CVE-2026-65390
  • CVE-2026-65391
  • CVE-2026-43760
  • CVE-2026-84581
  • CVE-2026-84535
  • CVE-2026-84516
  • CVE-2026-65415
  • CVE-2026-84568
  • CVE-2026-84607
  • CVE-2026-84631
  • CVE-2026-43786
  • CVE-2026-84575
  • CVE-2026-43691
  • CVE-2026-43698
  • CVE-2026-84505
  • CVE-2026-65362
  • CVE-2026-64758
  • CVE-2026-43684
  • CVE-2026-43689
  • CVE-2026-86917
  • CVE-2026-64712
  • CVE-2026-84515
  • CVE-2026-84506
  • CVE-2026-64761
  • CVE-2026-86895
  • CVE-2026-84563
  • CVE-2026-84606
  • CVE-2026-43661
  • CVE-2026-28969
  • CVE-2026-65343
  • CVE-2026-65364
  • CVE-2026-86894
  • CVE-2026-84543
  • CVE-2026-84553
  • CVE-2026-28930
  • CVE-2026-86904
  • CVE-2026-64752
  • CVE-2026-84611
  • CVE-2026-84632
  • CVE-2026-64736
  • CVE-2026-65349
  • CVE-2026-84537
  • CVE-2026-43788
  • CVE-2026-86882
  • CVE-2026-84519
  • CVE-2026-86879
  • CVE-2026-86885
  • CVE-2026-65412
  • CVE-2026-84596
  • CVE-2026-84597
  • CVE-2022-3437
  • CVE-2026-28934
  • CVE-2026-65347
  • CVE-2026-65395
  • CVE-2026-43687
  • CVE-2026-65330
  • CVE-2026-84538
  • CVE-2026-84588
  • CVE-2026-84487
  • CVE-2026-43719
  • CVE-2026-65365
  • CVE-2026-84536
  • CVE-2026-43677
  • CVE-2026-64715
  • CVE-2026-64753
  • CVE-2026-64787
  • CVE-2026-64778
  • CVE-2026-84560
  • CVE-2026-84619
  • CVE-2026-84554
  • CVE-2026-43664
  • CVE-2026-65404
  • CVE-2026-84523
  • CVE-2026-84586
  • CVE-2026-65407
  • CVE-2026-84593
  • CVE-2026-43763
  • CVE-2026-86905
  • CVE-2026-43737
  • CVE-2026-43738
  • CVE-2026-84489
  • CVE-2026-84534
  • CVE-2026-65409
  • CVE-2026-64756
  • CVE-2026-64760
  • CVE-2026-65401
  • CVE-2026-65402
  • CVE-2026-65405
  • CVE-2026-84517
  • CVE-2026-84521
  • CVE-2026-86903
  • CVE-2026-86883
  • CVE-2026-43741
  • CVE-2026-84491
  • CVE-2026-84576
  • CVE-2026-84555
  • CVE-2026-65413
  • CVE-2026-28937
  • CVE-2026-64718
  • CVE-2026-65393
  • CVE-2026-84617
  • CVE-2026-64788
  • CVE-2026-65341
  • CVE-2026-34979
  • CVE-2026-86876
  • CVE-2026-86889
  • CVE-2026-84492
  • CVE-2026-84630
  • CVE-2026-43690
  • CVE-2026-84518
  • CVE-2026-43795
  • CVE-2026-64780
  • CVE-2026-64781
  • CVE-2026-64784
  • CVE-2026-65331
  • CVE-2026-65332
  • CVE-2026-65333
  • CVE-2026-65334
  • CVE-2026-65335
  • CVE-2026-65336
  • CVE-2026-65337
  • CVE-2026-65338
  • CVE-2026-65340
  • CVE-2026-65351
  • CVE-2026-64782
  • CVE-2026-64779
  • CVE-2026-86910
  • CVE-2026-86888
  • CVE-2026-84587
  • CVE-2026-20683
  • CVE-2026-84601
  • CVE-2026-65408
  • CVE-2026-84520
  • CVE-2026-65381
  • CVE-2026-84522
  • CVE-2026-84584
  • CVE-2026-65342
  • CVE-2026-84525
  • CVE-2026-65339
  • CVE-2026-84583
  • CVE-2026-84570
  • CVE-2026-65410
  • CVE-2026-84616
  • CVE-2026-65406
  • CVE-2026-86878
  • CVE-2026-84567
  • CVE-2026-86893
  • CVE-2026-65399
  • CVE-2026-86891
  • CVE-2026-43683
  • CVE-2026-43789
  • CVE-2026-65344
  • CVE-2026-43702
  • CVE-2026-84624
  • CVE-2026-84559
  • CVE-2026-84574
  • CVE-2026-84511
  • CVE-2026-84571
  • CVE-2026-64790
  • CVE-2026-84540
  • CVE-2026-84541
  • CVE-2026-84612
  • CVE-2026-84512
  • CVE-2026-84550
  • CVE-2026-84552
  • CVE-2026-84565
  • CVE-2026-84510
  • CVE-2026-86900
  • CVE-2026-86901
  • CVE-2026-43785
  • CVE-2026-43688
  • CVE-2026-84524
  • CVE-2026-84569
  • CVE-2026-86911
  • CVE-2026-84618
  • CVE-2026-84533
  • CVE-2026-64714
  • CVE-2026-84564
  • CVE-2026-86869
  • CVE-2026-43743
  • CVE-2026-65398
  • CVE-2026-65354
  • CVE-2026-28935
  • CVE-2026-28968
  • CVE-2026-43790
  • CVE-2026-65358
  • CVE-2026-65359
  • CVE-2026-65360
  • CVE-2026-65369
  • CVE-2026-65371
  • CVE-2026-65377
  • CVE-2026-84507
  • CVE-2026-84530
  • CVE-2026-84544
  • CVE-2026-84549
  • CVE-2026-84558
  • CVE-2026-84561
  • CVE-2026-84566
  • CVE-2026-84602
  • CVE-2026-84622
  • CVE-2026-84514
  • CVE-2026-84556
  • CVE-2026-65382
  • CVE-2026-86870
  • CVE-2026-84577
  • CVE-2026-43787
  • CVE-2026-84573
  • CVE-2026-84628
  • CVE-2026-86924
  • CVE-2026-65411
  • CVE-2026-84598
  • CVE-2026-84497
  • CVE-2026-84615
  • CVE-2026-43695
  • CVE-2026-84585
  • CVE-2026-84626
  • CVE-2026-86902
  • CVE-2026-84629
  • CVE-2026-84623
  • CVE-2026-84578
  • CVE-2026-84580
  • CVE-2026-84548
  • CVE-2026-28966
  • CVE-2026-84532
  • CVE-2026-65403
  • CVE-2026-86897
  • CVE-2026-65380
  • CVE-2026-84551
  • CVE-2026-84603
  • CVE-2026-84625
  • CVE-2026-43697
  • CVE-2026-84526
  • CVE-2026-84546
  • CVE-2026-84620
  • CVE-2026-84531
  • CVE-2026-86881
  • CVE-2026-84600
  • CVE-2026-86884
  • CVE-2026-86890
  • CVE-2026-65376
  • CVE-2026-84509
  • CVE-2026-84609
  • CVE-2026-65361
  • CVE-2026-65378
  • CVE-2026-84621
  • CVE-2026-86892
  • CVE-2026-65345
  • CVE-2026-65348
  • CVE-2026-43791
  • CVE-2026-84513
  • CVE-2026-65383
  • CVE-2026-86909
  • CVE-2026-84527
  • CVE-2026-84589
  • CVE-2026-86886
  • CVE-2026-65329
  • CVE-2026-86887
  • CVE-2026-43696
  • CVE-2026-84572
  • CVE-2026-28899
  • CVE-2026-65375
  • CVE-2026-84635
  • CVE-2026-86898
  • CVE-2026-84636
  • CVE-2026-43674

Technologies named here

Techniques named here

  • Authentication bypass without valid credentials
  • Remote code execution via network protocol
  • Malicious image processing
  • Sandbox escape to kernel code execution
  • Remote kernel memory corruption

Related in other