Security2 publishers2 min readPublished
Deferring iOS 27 leaves about 56 of its 126 fixes out of the 26.7 build
Apple's September 14 releases close 273 unique vulnerabilities across ten advisories, with no exploitation reported. Fleet managers have to pick which lane to patch on, and the 26.7 build leaves out about 56 of the fixes that ship in iOS 27.
The Watch · Security desk
What happened
- Apple pushed security updates on September 14, 2026 across iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari and Xcode, covering both the 27 major releases and the 26.7 and 15.8 minor builds.
- macOS Golden Gate 27 took the largest share of the batch at 210 CVEs, followed by macOS Sequoia 15.8 at 154 and macOS Tahoe 26.7 at 153, according to The Cyber Express.
- The fixes touch more than 90 platform components, among them AppleKeyStore, Authentication Services, Foundation, Safe Browsing, Sandbox, Security, TCC and WebKit.
- Apple did not say any of the patched flaws had been exploited in the wild.
- iPhone owners see iOS 26.7 offered prominently in Settings with iOS 27 as a secondary option, a structure Apple keeps for months after a major release.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Any Mac with Screen Sharing reachable from the network belongs at the top of the inventory, because the pre-patch flaw there, CVE-2026-65400, gets past login credentials remotely.
- cost Apple's staged rollout can take days or weeks to reach every device, so closing that window early costs manual or managed installs instead of waiting on automatic updates.
- contradiction SecurityWeek counted more than 200 fixes and called the batch a record, while The Cyber Express consolidated the same advisories to 273 unique flaws, so a patch-coverage number reported to management needs its source named.
- constraint The minor lane runs on iPhone 11 and later, so the option to sit out iOS 27 exists only for devices Apple still serves with 26.7.
Ten advisories list the same bugs more than once. Consolidated, 1,038 product-level CVE entries come down to 273 distinct flaws [2][3], an average of 3.8 listings per flaw [1], because a fix in a shared framework ships in every operating system that carries that framework [3].
The gap between the two iPhone lanes is countable. iOS 27 and iPadOS 27 fix about 126 flaws, 20 of them in the kernel, according to SecurityWeek [5]. iOS 26.7 and iPadOS 26.7 fix more than 80, about 70 of which are also in the 27 build [8]. Subtract: roughly 56 of iOS 27's fixes are absent from 26.7, or about 44 percent of the major release's count [2]. Around ten of 26.7's fixes do not appear on the iOS 27 list at all [3].
The desktop split is narrower. More than 140 of macOS Sequoia 15.8's fixes are also in macOS Tahoe 26.7 [9], and Tahoe includes 26 kernel defects that could lead to memory corruption, privilege escalation, system termination and information leaks [7]. Roughly 100 of macOS Golden Gate 27's fixes are shared with iOS 27 [6].
On the phone, iOS 26.7 closes 16 kernel-level flaws, the most severe being CVE-2026-43689, which could have given a malicious app root, per The Cyber Express [17]. A race condition in AVEVideoEncoder, CVE-2026-84607, could have let a sandboxed app run code with kernel privileges [16]. Bluetooth had an out-of-bounds write, CVE-2026-65414, that could have let a remote attacker crash an app or run code [15]. And in WebKit, a use-after-free, CVE-2026-43715, could have corrupted memory through crafted web content [18].
Safari 27 took six fixes, one of them for cross-site scripting delivered through a malicious webarchive [26]. tvOS 27, watchOS 27 and visionOS 27 each got dozens of patches, and Xcode 27 got one [10].
The macOS update also closes CVE-2022-3437, a medium-severity heap-based buffer overflow in Samba within Heimdal that can cause denial of service, an identifier four years older than the rest of the batch [13][5].
What to watch
- Whether Apple backports the roughly 56 iOS 27-only fixes into a 26.7.x release or leaves the gap until fleets move.
- An amendment to any of the ten advisories flagging in-the-wild use of one of these CVEs.
- Public exploit work on CVE-2026-65400, the Screen Sharing Server credential bypass. That would change the urgency for Macs with the service exposed.