> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # The vulnpocalypse rains iBugs down on Apple with record-setting number of patches - URL: https://f4n6.co.uk/security-feed/the-vulnpocalypse-rains-ibugs-down-on-apple-with-record-setting-number-of-patches/ - Published: 2026-09-16T09:26:42.000Z - Updated: 2026-09-16T09:26:41.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-65410, CVE-2026-65409, CVE-2026-43689, CVE-2026-65406, CVE-2026-43692 ## 1\. Executive summary Apple has released its largest single patch cycle to date, addressing more than 260 CVEs across its operating systems, browsers and other products, including 122 fixes in iOS 27 and 204 in macOS 27 "Golden Gate", both released Monday 2026-09-14\. The most operationally significant entries for EMEA financial services estates are CVE-2026-43692 (CVSS 8.8 HIGH, CWE-20, EPSS 1%), a CUPS input-validation flaw exploitable by a remote user for code execution, and CVE-2026-43689 (CVSS 7.8 HIGH, CWE-862), a privilege-escalation flaw allowing an app to gain root. None of the ten CVEs in our verified reference set is listed in CISA KEV, and all carry EPSS of 1% or lower — there is no evidence of active exploitation at time of writing. The risk is therefore forward-looking: a large, freshly disclosed macOS attack surface (CUPS, SMB, WebDAV, StorageKit, Background Assets) with public technical detail and no observed exploitation yet. Clients running macOS endpoints in trading, treasury or branch environments should treat this as a scheduled emergency-patch cycle rather than an incident. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. This is a vendor patch cycle with no confirmed exploitation, no incident, and no third-party service disruption; the fact patterns that would trigger DORA Art. 17/18/19 (an ICT-related incident), DORA Art. 28/30 (a third-party contractual or concentration issue) or NIS2 Art. 23 (an incident with significant impact) are not present in the source material. Clients should nonetheless record the patch decision in their normal vulnerability-management evidence trail, since a later exploitation of these CVEs would engage those articles retrospectively. ## 3\. Technical analysis & attack chain This is a patch-roundup item covering more than five CVEs. The triage table below is ordered by CISA KEV status first (none), then by EPSS descending, then by CVSS descending, using the verified reference data. Full mechanism depth follows for the three most urgent entries; the remainder are covered by their table row. ### 3.1 Prioritised triage table | CVE | Component | CVSS | KEV / EPSS | Why it matters | | -------------- | --------------------------------------- | -------------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-43692 | CUPS (macOS 27) | 8.8 HIGH (CWE-20) | Not in KEV / EPSS 1% | Remote user can terminate the app or execute malicious code via the printer interface. Highest CVSS and highest EPSS in this set; CUPS listens on the network where enabled. | | CVE-2026-43689 | iOS 27 (app sandbox → root) | 7.8 HIGH (CWE-862) | Not in KEV / EPSS 0% | Local privilege escalation allowing an app to gain root. Post-exploitation multiplier on managed mobile fleets. | | CVE-2026-43719 | SMB (macOS 27) | 6.5 MEDIUM (CWE-416) | Not in KEV / EPSS 0% | Use-after-free; mounting a maliciously crafted SMB network share may lead to system termination. Relevant to file-share-heavy corporate networks. | | CVE-2026-65409 | Foundation framework (iOS 27, macOS 27) | 5.5 MEDIUM (CWE-843) | Not in KEV / EPSS 0% | Type-confusion issue abusable for denial of service. | | CVE-2026-43690 | SMB (macOS 27) | Unknown | Not in KEV / EPSS 0% | Race condition; a local user can read kernel memory. | | CVE-2026-65376 | SMB (macOS 27) | Unknown | Not in KEV / EPSS 0% | Out-of-bounds read. | | CVE-2026-64790 | CUPS (macOS 27) | Unknown | Not in KEV / EPSS 0% | Can be exploited to gain elevated privileges. | | CVE-2026-43791 | StorageKit (macOS 27) | Unknown | Not in KEV / EPSS 0% | Validation issue abusable to read files. | | CVE-2026-65406 | Background Assets (iOS 27) | Unknown | Not in KEV / EPSS 0% | Logic issue due to improper validation; abusable to access sensitive user data. | | CVE-2026-65410 | AVE video encoders (iOS 27, macOS 27) | Unknown | Not in KEV / EPSS 0% | Can cause unexpected system termination. | ### 3.2 CVE-2026-43692 — CUPS remote code execution (CVSS 8.8 HIGH) The verified classification is CWE-20 (Improper Input Validation); the source describes it as a "validation issue in CUPS" — consistent. A remote user can exploit the flaw to either terminate the CUPS application or execute malicious code. CUPS is the macOS printing subsystem; where it is reachable on the network (TCP/631), the remote attack surface is real, and printing is commonly enabled by default on macOS endpoints even when no local printer is attached. This is the single highest-priority item in the cycle: highest CVSS, the only CVE in the set with non-zero EPSS, and remote-reachable. Credit for disclosure goes to Aaron Grattafiori and the Nvidia AI Red Team. ### 3.3 CVE-2026-43689 — iOS privilege escalation to root (CVSS 7.8 HIGH) Verified classification is CWE-862 (Missing Authorization). The source describes it as a privilege-escalation flaw that could allow an app to gain root access — a description that is compatible with a missing-authorization root cause, though the two labels frame the flaw differently (authorization gap vs. escalation outcome). Both can describe the same defect; we use the verified CWE-862\. Impact is local: an already-installed app escalates to root, which is a meaningful post-exploitation step on supervised or MDM-managed iOS/iPadOS fleets. Credited to Nosebeard Labs' Andreas Jaegersberger and Ro Achterberg. ### 3.4 CVE-2026-43719 — SMB use-after-free (CVSS 6.5 MEDIUM) Verified classification is CWE-416 (Use After Free). Apple's own wording, quoted in the source: "Mounting a maliciously crafted SMB network share may lead to system termination." The trigger is user- or policy-driven mounting of an attacker-controlled SMB share, which makes it relevant to organisations where macOS clients mount shares from untrusted or partner-controlled infrastructure. Credited to Calif's Bruce Dang and Jakob Pammer, with Claude and Anthropic. ### 3.5 Remaining entries and source-only CVEs The remaining verified entries are covered in the table above. Note that the source also names three CVEs that do **not** appear in our verified reference data and for which we therefore carry no CVSS, CWE or EPSS value: CVE-2026-65374 (WebDAV memory corruption leading to code execution), CVE-2026-65375 (WebDAV, unexpected system termination) and CVE-2026-43677 (WebDAV out-of-bounds write). Treat these as unrated until vendor/NVD data is available; the WebDAV cluster is nonetheless worth including in the same patch action as the SMB cluster, since both are network-protocol parsers reachable from a client. ### 3.6 Attack chain No exploitation has been observed, so the following is the *potential* chain implied by the vulnerability classes, not a confirmed campaign. It is presented as such. 1. **Initial access (remote, CVE-2026-43692):** attacker reaches a macOS host with CUPS reachable on the network and sends crafted input to the printing service, achieving code execution or application termination. 2. **Initial access (adjacent, CVE-2026-43719 / CVE-2026-43690 / CVE-2026-65376):** attacker positions a malicious SMB share; a user or automated mount process connects, triggering use-after-free, kernel memory read, or out-of-bounds read. 3. **Initial access (adjacent, WebDAV cluster):** crafted WebDAV interaction triggers memory corruption with code-execution potential (CVE-2026-65374, source-only, unrated). 4. **Privilege escalation (CVE-2026-43689):** a local app on iOS escalates to root via a missing-authorization condition. 5. **Impact:** system termination (denial of service), kernel memory disclosure, file read (CVE-2026-43791), sensitive user data access (CVE-2026-65406), or code execution depending on the specific flaw. There is no source material describing persistence, command-and-control, lateral movement, exfiltration tooling or malware payloads for this cycle. We do not speculate on those stages. ### 3.7 Confidence caveats - The entire technical picture here rests on a **single source** (The Register, 2026-09-15), which is itself summarising Apple's security notes. Component names, affected frameworks and researcher credits are single-sourced; verify against Apple's published security advisories before using them for asset scoping. - The claim that **none of the vulnerabilities are under active exploitation** is the source's characterisation at publication time and is consistent with the verified KEV data (no KEV entries in this set). It is a point-in-time statement, not a guarantee. - The source's framing that AI-driven bug hunting is responsible for the volume is commentary, not a technical finding. Only ten of the hundreds of CVEs are credited to AI tooling per the source's own count. - No threat actor is named anywhere in this item. There is no attribution to assess and no MITRE ATT&CK profile to apply. ## 4\. Mitigation & containment ### P1 — within 24 hours - Patch macOS endpoints to **macOS 27 "Golden Gate"** and iOS/iPadOS devices to **iOS 27**. Prioritise, in order: (a) macOS hosts with CUPS enabled or reachable (CVE-2026-43692, CVE-2026-64790), (b) macOS hosts that mount SMB or WebDAV shares (CVE-2026-43719, CVE-2026-43690, CVE-2026-65376, plus the unrated WebDAV cluster), (c) iOS devices in the managed fleet (CVE-2026-43689, CVE-2026-65406). - Where patching cannot complete inside 24h, contain: disable the CUPS daemon (`cupsd`) on macOS hosts that do not require printing, and block inbound TCP/631 at the host firewall and at the network perimeter. Restrict outbound SMB (TCP/445) and WebDAV (TCP/80, 443 to untrusted hosts) from macOS clients to known-good file servers only. - Push the iOS 27 update via MDM as a supervised, enforced install rather than an optional user prompt. ### P2 — within 72 hours - Complete the macOS 27 and iOS 27 rollout across the remaining managed estate, including laptops, build agents and any macOS used for treasury, trading or administrative functions. - Inventory macOS hosts exposing CUPS, SMB or WebDAV listeners; where the service is not business-required, disable it permanently rather than relying on the patch alone. - Confirm no unsupported macOS or iOS versions remain in scope; older releases will not receive these fixes. ### P3 — within 7 days - Re-scan the estate to confirm version compliance and close exceptions with documented risk acceptance. - Track CVE-2026-65374, CVE-2026-65375 and CVE-2026-43677 for NVD/vendor scoring and fold them into the same remediation record. - Review endpoint detection coverage for anomalous `cupsd` behaviour, unexpected SMB mount attempts from macOS clients, and WebDAV client crashes — the observable precursors to exploitation of this cycle. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes vulnerability classes and affected components only; it publishes no hashes, domains, IP addresses, file paths, registry keys or command lines, and no exploitation has been observed. There are therefore no atomic indicators to pivot on and no behavioural indicators with sufficient specificity to tabulate. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no threat artefacts — no distinctive strings, command-line flags, mutexes, scheduled-task or service names, file names, registry keys, ransom-note text or hard-coded values. CVE identifiers, Apple product names and researcher names are not artefacts of a threat and would produce rules that match reporting about this cycle rather than any malicious activity. ## CVE assessment 10 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-43692](https://nvd.nist.gov/vuln/detail/CVE-2026-43692?ref=f4n6.co.uk) | 8.8 High | — | 1% | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 1… | | [CVE-2026-43689](https://nvd.nist.gov/vuln/detail/CVE-2026-43689?ref=f4n6.co.uk) | 7.8 High | — | 0% | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPa… | | [CVE-2026-43719](https://nvd.nist.gov/vuln/detail/CVE-2026-43719?ref=f4n6.co.uk) | 6.5 Medium | — | 0% | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoi… | | [CVE-2026-65409](https://nvd.nist.gov/vuln/detail/CVE-2026-65409?ref=f4n6.co.uk) | 5.5 Medium | — | 0% | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and… | | [CVE-2026-65410](https://nvd.nist.gov/vuln/detail/CVE-2026-65410?ref=f4n6.co.uk) | — | — | 0% | The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gold… | | [CVE-2026-65406](https://nvd.nist.gov/vuln/detail/CVE-2026-65406?ref=f4n6.co.uk) | — | — | 0% | A logic issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, ma… | | [CVE-2026-64790](https://nvd.nist.gov/vuln/detail/CVE-2026-64790?ref=f4n6.co.uk) | — | — | 0% | A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8,… | | [CVE-2026-43791](https://nvd.nist.gov/vuln/detail/CVE-2026-43791?ref=f4n6.co.uk) | — | — | 0% | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 1… | | [CVE-2026-43690](https://nvd.nist.gov/vuln/detail/CVE-2026-43690?ref=f4n6.co.uk) | — | — | 0% | A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta… | | [CVE-2026-65376](https://nvd.nist.gov/vuln/detail/CVE-2026-65376?ref=f4n6.co.uk) | — | — | 0% | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 1… | ## 7\. Sources - The Register — "The vulnpocalypse rains iBugs down on Apple with record-setting number of patches" — https://www.theregister.com/security/2026/09/15/the-vulnpocalypse-rains-ibugs-down-on-apple-with-record-setting-number-of-patches/5296679 — 2026-09-15 ## 8\. Adverse Trace position We assess this as a **high-volume, low-urgency patch cycle with one item that warrants immediate attention**. CVE-2026-43692 (CVSS 8.8 HIGH, CWE-20, EPSS 1%) is the only entry in the set with non-zero EPSS and remote code-execution potential, and it is the reason we are issuing at all; CVE-2026-43689 (CVSS 7.8 HIGH) is the second priority for managed mobile fleets. Nothing in this set is in CISA KEV and we have no evidence of exploitation, so we are not raising a client incident posture — this is a scheduled emergency-patch action, not a compromise response. Client impact is concentrated in organisations with macOS endpoints that expose CUPS, mount SMB/WebDAV shares from semi-trusted sources, or run unsupervised iOS devices. The technical detail here is **single-sourced** to one trade-press article summarising Apple's advisories; verify component and version claims against Apple's own security notes before scoping remediation, and treat the three WebDAV CVEs named only in the source as unrated. We will monitor for KEV additions, EPSS movement on CVE-2026-43692, and any public proof-of-concept or in-the-wild exploitation, and will re-issue if the exploitation status changes. --- [Read the original source →](https://www.theregister.com/security/2026/09/15/the-vulnpocalypse-rains-ibugs-down-on-apple-with-record-setting-number-of-patches/5296679?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*