Apple has delivered an unusually broad security update spanning iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari and Xcode. Across ten advisories, the company addressed 273 unique CVE identifiers, making the release a significant patching event for consumers and organizations managing mixed Apple fleets.

One release across a shared ecosystem

The fixes arrived through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27, with updates also issued for older supported operating-system branches. Apple’s bulletins list more than a thousand product-level CVE appearances because the same shared framework can affect several platforms. When duplicates are removed, the total is 273 distinct vulnerabilities.

macOS Golden Gate 27 has the largest individual set with 210 CVEs, followed by macOS Sequoia 15.8 with 154 and macOS Tahoe 26.7 with 153. The overlap demonstrates why focusing only on phones or only on laptops leaves gaps. Common libraries for graphics, media and networking can spread a single underlying weakness across many device classes.

Code execution and kernel-level risks

Among the serious issues is CVE-2026-65414, an out-of-bounds write in Bluetooth that could allow a remote attacker to crash an application or potentially execute code. CVE-2026-84607 is a race condition in AVEVideoEncoder through which a sandboxed application could gain the ability to execute code with kernel privileges. Apple strengthened bounds checks and state management to address the respective problems.

Media parsing received extensive attention. A CoreMedia flaw, CVE-2026-64752, could lead to code execution when processing a crafted image, while CVE-2026-65395 in ImageIO could cause memory corruption. Font, 3D-model, user-interface and disk-image components received further fixes for unsafe memory access, information disclosure and denial of service.

Mac services and privacy controls hardened

Several macOS fixes close privilege-escalation or security-bypass paths. A weakness in autofs could permit code execution as root when an attacker controls a network directory server. A CUPS printing flaw could allow a remote user to crash a service or run code. Apple also reinforced Gatekeeper, sandboxing, quarantine, privacy controls and several filesystem and network protocols.

CVE-2026-65400 in the macOS Screen Sharing Server is particularly notable because a network attacker could access screen sharing without valid authentication. Other corrections protect sensitive files, persistent device identifiers, location data and privacy preferences. Components touched by the release include Keychain, CloudKit, Photos, Siri, Shortcuts and Sign in with Apple.

Web content remains a major attack surface

WebKit patches address memory corruption, use-after-free conditions, information leaks and cross-site scripting. Safari 27 resolves six CVEs, including a universal cross-site scripting issue involving malicious webarchives and an information-disclosure problem during web-content processing. Developer systems also require attention: Xcode 27 fixes a permissions weakness capable of exposing user-sensitive data.

Priorities for deployment

• Inventory every supported Apple platform, including shared and specialist devices.
• Prioritize internet-facing Macs, developer machines and systems processing untrusted media.
• Test essential business applications, then enforce updates through device management.
• Monitor for unusual crashes, unauthorized screen sharing and privacy-control changes.

Apple’s advisories do not say that these vulnerabilities were exploited before the patches appeared. Even so, disclosure gives researchers and criminals information they can use to compare old and new code. Organizations should use staged testing where necessary, but a large inventory should not become a reason for open-ended delay.

The update’s scale is best understood as a fleet-management challenge rather than a single headline number. Shared architecture improves consistency, but it also means that one vulnerable framework can affect phones, workstations and emerging device categories at once. Complete asset visibility and verified installation are essential to reducing that shared exposure.

Users should check Software Update on every compatible device rather than assuming that automatic updating has finished. Enterprises should compare device-management reports with active-version telemetry, document justified exceptions and remove unsupported hardware from sensitive workflows when no secure upgrade path remains.