Apple Fixes Record 200+ Security Flaws With iOS 27 and macOS Golden Gate 27 Releases

Apple has released one of its largest security updates of the year, addressing approximately 200 vulnerabilities across iPhones, iPads, Macs and other products as part of the launch of iOS 27, iPadOS 27 and macOS Golden Gate 27.

The update also delivered security fixes for devices remaining on earlier operating-system branches, including iOS and iPadOS 26.7, macOS Tahoe 26.7 and macOS Sequoia 15.8. Apple simultaneously published updates for Safari, Apple Watch, Apple TV, Apple Vision Pro and Xcode.

The vulnerabilities span core components including the operating-system kernel, WebKit, Bluetooth, CoreMedia, Apple Neural Engine, authentication services, file-system drivers, Gatekeeper, Keychain, Mail, networking protocols and multiple privacy controls.

Successful exploitation of the most serious weaknesses could allow an attacker to execute arbitrary code, obtain kernel-level privileges, escape an application sandbox, bypass Gatekeeper security checks, access protected files, expose sensitive information or crash an affected device.

The scale of the fixes reflects the extensive amount of shared code running across Apple’s expanding product ecosystem.

The total should not, however, be interpreted as 200 entirely separate flaws affecting every Apple device. Many CVE identifiers appear in more than one advisory because components such as WebKit, CoreMedia, Bluetooth and the XNU kernel are shared across multiple operating systems. A single underlying vulnerability may consequently be corrected in iOS, iPadOS, macOS, watchOS, tvOS and visionOS at the same time.

Read Apple's Security Release Documentation HERE

Serious Kernel and Privilege-Escalation Flaws Patched

Some of the most consequential vulnerabilities affect the kernel and other highly privileged parts of Apple’s operating systems.

The kernel controls essential functions such as memory management, hardware access, process isolation and enforcement of security boundaries. A vulnerability that provides kernel privileges can therefore undermine protections that normally prevent applications from interfering with the rest of the operating system.

One particularly significant issue, tracked as CVE-2026-84607, was caused by a race condition. Apple said a sandboxed application could exploit the flaw to execute arbitrary code with kernel privileges. The company addressed the vulnerability through improved state management.

This type of weakness is especially dangerous because it can potentially provide the privilege-escalation stage of a multi-step exploit chain. An attacker might first gain limited code execution through a malicious document, web page or compromised application and then use a kernel flaw to obtain deeper control of the device.

Apple also corrected CVE-2026-84523, an out-of-bounds write vulnerability that could allow an application to terminate the system unexpectedly or write to kernel memory. Out-of-bounds writes occur when software places data outside the memory area allocated to it, potentially corrupting adjacent memory and creating opportunities for denial-of-service attacks or code execution.

The macOS Golden Gate 27 advisory describes multiple additional kernel problems capable of corrupting memory, exposing kernel information or crashing an affected computer. These include race conditions, use-after-free weaknesses, memory-initialisation errors and flaws triggered by connections to malicious network file-system servers.

One vulnerability, CVE-2026-43689, could allow a malicious application to obtain root privileges. Root access represents the highest conventional privilege level on macOS and can provide control over system files, security settings and other users’ data.

Other kernel weaknesses could be exploited through malicious Network File System connections. Apple documented flaws that could corrupt kernel memory, disclose kernel data or terminate the operating system when a Mac connected to a hostile NFS server. These findings are particularly relevant to enterprise and development environments where network file shares are routinely mounted.

Although some of these vulnerabilities require a malicious application to be installed or an attacker to occupy a specific network position, they remain important because sophisticated attacks frequently combine several individually limited flaws. A sandbox escape or kernel privilege-escalation vulnerability can transform an initial foothold into extensive control of a device.

Bluetooth Vulnerability Could Enable Remote Code Execution

Apple also fixed a serious Bluetooth memory-safety vulnerability identified as CVE-2026-65414.

According to the company’s iOS 27 and iPadOS 27 security advisory, the out-of-bounds write could allow a remote attacker to trigger an application crash or execute arbitrary code. Apple addressed the problem through improved bounds checking.

Apple’s description does not indicate that the flaw can be exploited globally over the internet. Bluetooth attacks ordinarily require the threat actor to be within wireless range of the targeted device and may depend on its Bluetooth state or other environmental conditions.

Nevertheless, remotely reachable flaws in a wireless communications stack are significant because they may reduce the need for a victim to open a file, install an application or visit a hostile website. Bluetooth vulnerabilities can also be particularly relevant in high-density environments such as airports, hotels, conferences, offices and public transport systems.

A second Bluetooth flaw, CVE-2026-84560, could allow an application to gain unauthorised access to Bluetooth functionality. On macOS, Apple also corrected CVE-2026-84631, an entitlement-related weakness that could enable an application to acquire root privileges.

Together, the findings demonstrate that Bluetooth security extends beyond direct wireless attacks. Permission and entitlement errors can also enable malicious local applications to misuse the framework or cross operating-system security boundaries.

Malicious Images, Video and Media Files Pose Code-Execution Risk

Several vulnerabilities involved the processing of images, video, fonts and other complex file formats.

CVE-2026-64752, affecting CoreMedia, could lead to arbitrary code execution when a device processed a maliciously crafted image. Apple described the weakness as a memory-corruption issue and said it removed the vulnerable code.

Media-processing vulnerabilities are potentially valuable to attackers because specially crafted content may reach a device through numerous channels, including websites, email, messaging services, shared documents and cloud-based applications. Whether user interaction is required depends on the affected component and how the malicious file is delivered.

Other vulnerabilities could cause crashes or disclose process memory when the system processed malformed images, videos, fonts, documents or asset catalogues. These weaknesses included buffer overflows, out-of-bounds reads and writes, type-confusion errors and use-after-free conditions.

An out-of-bounds read can expose data that should not be accessible to the affected process, while an out-of-bounds write may corrupt memory. Use-after-free vulnerabilities arise when software continues using memory after it has been released, potentially allowing an attacker to influence what occupies that memory location.

Apple’s updates also corrected weaknesses in CoreText and FontParser. Crafted fonts could cause application termination or disclose portions of process memory. Fonts are frequently embedded in websites and documents, which makes safe parsing an important security boundary.

Gatekeeper Bypasses and Sandbox Escapes Affect Macs

The macOS fixes include a substantial group of vulnerabilities capable of weakening Apple’s layered application-security model.

Gatekeeper is designed to assess downloaded software and enforce requirements involving code signing, notarisation and application provenance. It is not intended to replace endpoint security products, but it forms an important barrier between users and untrusted applications downloaded from the internet.

Apple corrected multiple issues that could allow applications, archives or system components to bypass Gatekeeper checks. One flaw affected the handling of file quarantine metadata, while another involved the autofs component. A separate System Settings vulnerability, CVE-2026-65383, could also allow an application to evade Gatekeeper.

Apple additionally fixed two weaknesses in the macOS quarantine subsystem that could let an application escape its sandbox. Sandboxing restricts an application’s access to files, system services and other processes. Escaping that boundary can enable malicious code to reach information or functions that would otherwise remain protected.

CVE-2026-65381 affected AppleMobileFileIntegrity, a component involved in enforcing code and entitlement restrictions. Apple said faulty entitlement verification could allow a malicious application to break out of its sandbox.

A separate iWork vulnerability, CVE-2026-65354, carried the same potential consequence. Apple corrected it by applying additional permission restrictions.

Archive Utility also received security improvements. One flaw could permit a sandbox escape through improper handling of symbolic links, while another race condition could expose sensitive user information. A related path-handling issue in the file_cmds component could allow a malicious archive to write arbitrary files during extraction.

These weaknesses are relevant to attacks built around apparently legitimate disk images, archives or document packages. Attackers frequently use compressed files to conceal malicious content and evade email or web-security controls.

Privacy Controls and Sensitive Data Access Strengthened

A large proportion of the vulnerabilities involved privacy enforcement rather than direct remote code execution.

Apple corrected flaws that could permit applications to access protected user information, learn which other apps were installed, read persistent account or device identifiers, determine a user’s location, retrieve device names or bypass privacy preferences.

An Accounts vulnerability tracked as CVE-2026-65404 could allow a malicious application to bypass privacy settings because of an authorisation error. Apple said it corrected the problem with improved state management.

A flaw in Apple Account functionality, CVE-2026-20683, could allow an application to abuse the Sign in with Apple authentication flow to access a user’s Apple Account. Apple described it as an authentication issue and implemented improved state handling.

Camera, CloudKit, CoreMotion, Photos Storage, Spotlight, Mail, QuartzCore and Software Update were among the components receiving privacy or information-access corrections.

CVE-2026-43737, affecting CoreMotion, could allow an application to access motion information from headphones without the user’s consent. Other bugs could expose persistent identifiers useful for tracking a user or correlating activity across applications.

On macOS, CVE-2026-84513 could enable a malicious application to determine a user’s current location through information written to log entries. Apple addressed the issue by improving the redaction of private data.

Although privacy vulnerabilities may appear less severe than kernel code execution, they can still carry considerable security implications. Device identifiers, installed-application lists, file paths, location information and account data can support surveillance, profiling and targeted social-engineering operations.

Keychain and Authentication Protections Updated

Apple’s Keychain and authentication frameworks were also included in the security overhaul.

A flaw in Authentication Services, CVE-2026-86905, could allow an application to delete credentials stored in Keychain. Rather than applying a narrower validation fix, Apple said it removed the vulnerable code.

Another problem involving AppleKeyStore was caused by a use-after-free condition and could allow an application to terminate the system unexpectedly. Key-management components are high-value targets because they help protect credentials, encryption material and other secrets.

Separately, a Foundation vulnerability identified as CVE-2026-86911 could allow a malicious application to bypass clickjacking protections used for secure prompts. Clickjacking attacks manipulate an interface or overlay deceptive content so that a victim unknowingly authorises an action different from the one displayed.

A successful bypass affecting secure prompts could make it easier for malicious software to trick users into granting permissions or approving sensitive operations. Apple corrected the issue through improved state management.

Network Attack Surface Includes Baseband, SMB and CUPS

The release also addresses several weaknesses that could be reached through local or remote network interactions.

Two baseband vulnerabilities affected iPhone models. CVE-2026-86885 could allow an attacker within radio range to crash a device, while CVE-2026-86879 could enable a remote denial-of-service attack. Baseband software manages communication between the device and cellular networks and operates in a highly privileged environment separated from the main operating system.

On macOS, an SMB flaw designated CVE-2026-84509 could trigger an unexpected system termination when a computer connected to a malicious server. Another vulnerability in smbx could permit remote denial of service through resource exhaustion.

Apple also fixed security issues in CUPS, the open-source printing system used by macOS. One could allow an application to obtain root privileges, while another could be exploited by an attacker in a privileged network position to cause a denial of service.

A vulnerability in Heimdal, an implementation of Kerberos-related security functionality, could allow a network-positioned attacker to modify network traffic because of deficient cryptographic integrity checks. Apple also incorporated a correction for an older Heimdal vulnerability that could leak sensitive information.

The phrase “privileged network position” generally means the attacker must be able to observe, intercept or manipulate traffic between the target and another system. That condition may be achievable on a compromised corporate network, hostile Wi-Fi hotspot or network controlled by the attacker.

Older Operating Systems Receive Parallel Security Updates

Apple did not limit its September patches to users immediately moving to the newest operating systems.

The company released iOS 26.7 and iPadOS 26.7 for devices remaining on the previous platform generation. Mac users also received macOS Tahoe 26.7 and macOS Sequoia 15.8, while Safari 27 was made available for systems running Tahoe and Sequoia.

This parallel patching is particularly important for enterprises, where organisations may delay a major operating-system migration while compatibility testing is completed. Security teams can deploy the latest point release for the existing platform without immediately introducing all of the functional and interface changes contained in a major upgrade.

However, Apple’s security advisories should be reviewed carefully because older releases may not receive precisely the same collection of fixes as the newest operating system. Administrators should not assume that installing one update branch produces an identical security posture to upgrading to iOS 27 or macOS Golden Gate 27.

The new iOS and iPadOS releases support iPhone 11 and later, the fourth-generation 12.9-inch iPad Pro and later, the second-generation 11-inch iPad Pro and later, the fourth-generation iPad Air and later, the ninth-generation iPad and later, and the sixth-generation iPad mini and later.

macOS Golden Gate 27 is available only for supported Apple-silicon Macs, including Apple-silicon MacBook Air and MacBook Pro models introduced from 2020, Apple-silicon iMac models from 2021, Mac mini models from 2020, Mac Studio models from 2022, Mac Pro models from 2023 and the 2026 MacBook Neo. Older supported Macs that cannot move to Golden Gate should receive the appropriate Tahoe or Sequoia update where available.

Apple also released watchOS 27 for Apple Watch Series 9 and later, tvOS 27 for the second-generation Apple TV 4K and later, and visionOS 27 for all Apple Vision Pro models. Xcode 27 was issued for development systems running macOS Tahoe 26.6 or later.

No Confirmed Zero-Day Exploitation Disclosed

Apple’s published advisories do not state that any of the vulnerabilities in this release were exploited before patches became available.

That is an important distinction because Apple normally includes explicit language when it is aware that a flaw “may have been exploited” in targeted or active attacks. The absence of such a warning means the company has not publicly confirmed exploitation; it does not prove that exploitation has never occurred.

The breadth and severity of the vulnerabilities still justify prompt deployment. Public release of patches and CVE information can give attackers enough technical direction to compare old and new code, identify the changes and attempt to develop working exploits.

This process, often described as patch diffing, means the risk can increase after an update is published. Devices that remain unpatched provide attackers with a stable target while researchers and threat actors analyse the corrections.

Enterprise Security Teams Face a Large Testing and Deployment Task

For organisations managing Apple fleets, the September release requires more than simply approving a consumer operating-system upgrade.

Security teams should establish which devices can run iOS 27, iPadOS 27 or macOS Golden Gate 27 and identify systems that must remain on iOS 26, Tahoe or Sequoia. Unsupported or unmanaged devices should be located before they become long-term gaps in the organisation’s security posture.

Administrators should prioritise devices used by executives, system administrators, software developers, security personnel and other high-value users. These endpoints frequently hold privileged credentials or provide access to sensitive corporate services.

Testing should include business-critical applications, identity providers, virtual private network clients, endpoint-detection software, content filters, device-management agents, kernel or system extensions, certificate-based authentication and specialised hardware.

After approving the updates, organisations should verify installation through their mobile-device-management or endpoint-management platforms. Merely sending an update command does not guarantee that a device successfully downloaded, installed and restarted into the corrected version.

Security teams should also review software-update deferral policies. Long delays intended to minimise operational disruption can leave systems exposed after technical details about the vulnerabilities become more widely available.

Where immediate upgrades are impossible, compensating controls should include application allow-listing, restrictions on untrusted software and disk images, web filtering, endpoint monitoring, least-privilege access and segmentation of systems that use NFS, SMB or other network services implicated in the advisories.

Users Urged to Install Updates Promptly

Individual iPhone and iPad users can check for the latest release by opening Settings, selecting General, and then choosing Software Update.

Mac users can open System Settings, select General, and choose Software Update. Users should save their work and create a current backup before starting a major operating-system upgrade.

Automatic updates should be enabled where practical, although users should still verify the installed version because a device may postpone installation while it waits for sufficient battery power, storage space, a restart or a suitable network connection.

The approximately 200 vulnerabilities addressed across Apple’s September release cycle do not all present an equal or immediate risk. Some require local access, an already-installed application, a specially positioned network attacker or interaction with malicious content.

Taken together, however, the patches close numerous paths that could be combined in sophisticated attacks. The presence of kernel privilege escalation, sandbox escape, Bluetooth code execution, Gatekeeper bypass and media-processing vulnerabilities makes the release a significant security event for both consumers and organisations operating Apple devices.