Apple has fixed 273 vulnerabilities across iPhone, iPad, Mac, Watch, and Safari. Find out what the update addresses and how to install it.
What Happened
On September 14, 2026, Apple released one of its most extensive security update packages to date. It fixed 273 unique vulnerabilities (CVEs) across its entire ecosystem—iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode—all at once.
The updates apply to the operating systems iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, as well as Safari 27 and Xcode 27, along with older branches iOS/iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8.
The number 273 represents the number of unique vulnerabilities after removing duplicates—the individual bulletins contain a total of 1,038 entries, as many flaws in shared frameworks recur across multiple products. macOS Golden Gate 27 contains the most fixes (210 CVEs), followed by macOS Sequoia 15.8 (154) and macOS Tahoe 26.7 (153).
Among the most serious are:
- a vulnerability in the Bluetooth module that could have allowed an attacker to remotely execute arbitrary code,
- a flaw in image processing (CoreMedia, ImageIO), exploitable via a specially crafted file,
- a flaw in the macOS Screen Sharing Server that could have allowed an attacker on the network to access screen sharing without valid login credentials,
- and multiple vulnerabilities in WebKit (Safari), including the possibility of cross-site scripting via a malicious web archive file.
Apple also stated that none of the 273 vulnerabilities had been exploited in the wild at the time of the update’s release—however, the published technical details could make it easier for attackers to develop exploits, so prompt installation is important.
Who is affected
Virtually every user of Apple devices—this is a broad update across the entire product portfolio. The following groups should be especially vigilant:
- companies with Mac devices connected to the internet,
- development teams using Xcode,
- organizations with Bluetooth enabled on corporate devices,
- environments with shared workstations,
- devices with access to external file servers.
What to Do
- Immediately install the latest compatible update via Software Update on all devices—not just iPhones, but also Macs, Apple Watches, Apple TV, and other devices.
- Companies should use MDM (mobile device management) tools to verify that the update has been deployed to all managed devices.
- Prioritize updating devices exposed to the internet, devices that process untrusted files or media, and developer workstations.
- Monitor for unusual app crashes, unexpected changes to privacy settings, or suspicious network activity after installation.
