Apple shipped its September 2026 security update on September 14, patching 273 vulnerabilities across iOS 26.7, iPadOS 26.7, macOS Tahoe 26.7, macOS Sequoia 15.8, tvOS 27, watchOS 27, visionOS 27, Safari 27, and Xcode 27. The standout is CVE-2026-65414, a critical out-of-bounds write in Bluetooth that lets a remote attacker crash an app or run arbitrary code with no privileges and no user interaction, and it hits all eight platforms at once. Apple’s advisory doesn’t say this one has been exploited in the wild yet, but it’s the broadest-reach critical bug in the release. Get every Apple device your team or your clients rely on updated this week rather than waiting for the next release cycle.
A Bluetooth Flaw That Touches Every Apple Platform
CVE-2026-65414 carries a CVSS score of 9.8. The bug lives in how Bluetooth handles incoming data, and a malformed input can trigger memory corruption that an attacker turns into code execution, according to Apple’s own security content page for iOS 26.7 and iPadOS 26.7. What makes it worth flagging over the other 272 fixes in this release is reach: it’s patched identically across iPhone, iPad, Mac, Apple TV, Apple Watch, and Vision Pro, and it needs zero interaction from the person holding the device. Zero Day Initiative’s review of the release notes it as the release’s most likely candidate for a future CISA Known Exploited Vulnerabilities listing, precisely because an unauthenticated, no-click Bluetooth RCE is the kind of bug attackers build wormable exploits around.
Two other fixes in the same update are worth knowing even if they didn’t get the same attention. CVE-2026-43689 is a kernel flaw that could let a malicious app escalate to root privileges once it’s running on a device, which matters most for anyone sideloading or testing apps outside the App Store review process. CVE-2026-43715 is a WebKit memory corruption bug triggered by malicious web content, so it’s a drive-by risk for anyone browsing in Safari or any app that embeds WebKit.
What to Actually Do about It
Push the update now. Devices still on iOS 26 get iOS 26.7, and newer-eligible hardware can jump to iOS 27, both released the same day and both closing all 273 holes. If you manage a device fleet through MDM, treat this one like the Screen Sharing bug Apple patched last month: don’t wait for a staged rollout window, force it. Teams shipping their own iOS or cross-platform apps should also confirm their CI builds and test devices are running the current OS before the next release, since kernel and WebKit changes like these occasionally surface behavior differences that don’t show up until you’re testing on the patched build. That kind of pre-release regression check is part of what we run for clients under mobile application development work, and it’s cheaper to catch during a routine OS bump than after a client reports something broken in production.
This is the second major Apple security cycle in as many months, following the iOS 26.6.1 update in August that closed nearly 30 flaws. Neither cycle is unusual on its own, but the pace is a reminder that “we’ll update next sprint” isn’t really a policy for mobile fleets anymore.
