Apple security updates, September 2026: five critical core OS flaws lead 118 fixes

The release at a glance

Apple's September 2026 security release covers 118 CVEs across iOS, iPadOS, macOS, tvOS, visionOS, watchOS and Safari. The distribution is five critical, 28 high, 80 medium and five low severity issues. No in-scope CVE is marked as exploited and none appears in CISA's Known Exploited Vulnerabilities catalog. The highest-impact items are memory corruption, permissions and certificate validation flaws in core operating system components. Updates are available for iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. See Apple's release notes for the full mapping.

What matters most

These are the first CVEs to review:

Core operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS)

• CVE-2026-65414: out-of-bounds write; a remote attacker may be able to cause unexpected app termination or arbitrary code execution. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
• CVE-2026-84561: double free; an app may be able to cause unexpected system termination or corrupt kernel memory. Fixed in the same versions as CVE-2026-65414.
• CVE-2026-84609: permissions issue; an app may be able to modify protected system files. Fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27.
• CVE-2026-86881: certificate validation issue; an attacker with a compromised intermediate certificate authority may issue certificates with arbitrary extended key usages. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
• CVE-2026-43686: use-after-free when connecting to a malicious NFS server; may lead to kernel memory corruption. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
• CVE-2026-65354: sandbox escape; a malicious app may break out of its sandbox. Fixed in iOS 27 and iPadOS 27, and macOS Golden Gate 27.
• CVE-2026-43689: permissions issue; a malicious app may gain root privileges. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Patch in this order

1. Apply the current Apple OS updates first: iOS 26.7 or iOS 27 for iPhone and iPad; macOS Sequoia 15.8, Tahoe 26.7 or Golden Gate 27 for Mac; tvOS 27, visionOS 27 and watchOS 27. This addresses the remote code execution, kernel memory corruption and protected system file modification flaws CVE-2026-65414, CVE-2026-84561, CVE-2026-84609 and CVE-2026-86881.
2. Within that rollout, prioritise devices that leave the corporate network and Macs that connect to untrusted file shares, particularly NFS, because CVE-2026-43686 is triggered by connecting to a malicious NFS server.
3. Patch remaining high-severity local or app-mediated issues in the same cycle: CVE-2026-84566, CVE-2026-65354, CVE-2026-43689 and CVE-2026-65415.
4. Include Safari in the update cycle; the release contains Safari-related medium-severity items. Then schedule the remaining medium and low severity patches through normal change management.

Beyond the patch

Broad Apple releases such as this become easier to manage when you know which devices are exposed and which update path matters most. Virtual CISO Services can provide that outside-in view and help sequence the rollout so the highest-risk devices are patched first.