Apple Patches Record 261 Flaws Across New Operating Systems

Apple released its annual operating-system update on 14 September 2026, introducing version 27 across iOS, iPadOS, macOS, tvOS, watchOS and visionOS, alongside bug-fix releases for version 26 and macOS Sequoia 15.8. According to the SANS Internet Storm Centre, the releases address 261 vulnerabilities — reportedly Apple’s largest patch total so far. Apple did not assign individual severity ratings, and none of the flaws was identified as being exploited.

The fixes affect a wide range of components, including the kernel, WebKit, ImageIO, CUPS, SMB, WebDAV, Gatekeeper and security controls. Potential impacts listed include arbitrary code execution, root or kernel-level privileges, sandbox escapes, memory corruption, sensitive-data disclosure, authentication bypasses and denial-of-service conditions.

Examples include CVE-2026-84506, which could allow arbitrary code execution with kernel privileges; CVE-2026-65400, which could permit network authentication to Screen Sharing without valid credentials; and CVE-2026-84607, under which a sandboxed app could execute code with kernel privileges. These are potential impacts described in the advisories, not confirmed attacks.

The report also notes user reports of confusing iOS 27 downloads, with some devices displaying iOS 26.7 even though version 27 may have been installed. Users upgrading macOS should check compatibility for security tools: Little Snitch has issued an update required before moving to macOS 27, while Objective-See’s BlockBlock reached version 2.5.2 to improve compatibility.