In short: On September 14, 2026 Apple released iOS 26.7, iOS 27, and companion updates across all platforms, patching 273 distinct CVEs. The most dangerous is CVE-2026-65414 — a critical Bluetooth flaw (CVSS 9.8) enabling remote code execution on every Apple platform with zero user interaction. If you haven't updated yet, do it now.
What happened: Apple's biggest security batch of 2026
September 14, 2026 was an unusually large Apple security day: the company shipped updates across ten platforms simultaneously, addressing 273 unique CVEs. The release covers iOS 26.7 and iOS 27 (available in parallel for those who prefer to stay on the older branch), iPadOS 26.7 and 27, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, tvOS 27, watchOS 27, visionOS 27, Safari 27, and Xcode 27.
Of the 273 CVEs, 134 have received CVSS scores: two Critical, 46 High, 84 Medium, two Low. The remaining 139 await NVD scoring. iOS 26.7 alone closes 82 security issues plus 50 WebKit bugs — plenty of reason to update even without switching to iOS 27. Track the latest threats on LiMP VPN's security blog.
CVE-2026-65414: a Bluetooth flaw that hits every Apple device
The defining vulnerability of the September batch is CVE-2026-65414 in the Bluetooth stack. A CVSS score of 9.8 is reserved for the most severe vulnerabilities. What makes this one especially alarming:
- Scope: all eight Apple OS platforms — iPhone, iPad, Mac, Apple Watch, Apple TV, Apple Vision Pro, and more.
- Attack vector: network — no physical access required.
- Privileges needed: none.
- User interaction: none — the victim only needs Bluetooth switched on and to be within range.
Bluetooth operates at 2.4 GHz with a typical indoor range of 10–15 metres, making a crowded café, airport lounge, or open-plan office a viable attack environment. Successful exploitation grants the attacker arbitrary code execution. Zero Day Initiative analysts rated CVE-2026-65414 as "the most likely candidate for active exploitation" across the entire September batch. Pairing an encrypted tunnel via LiMP VPN with a patched OS delivers layered defence — both matter.
Other high-severity issues: video codecs, CUPS, and kernel escalation
Beyond CVE-2026-65414, three other vulnerabilities in the September update stand out:
- CVE-2026-84607 (AVEVideoEncoder, CVSS 7.8): an overflow in Apple's hardware video encoder allows a sandboxed app to escalate to kernel privileges. A malicious app or specially crafted video file is enough to trigger it.
- CVE-2026-43692 (CUPS, CVSS 8.8): remote code execution in macOS's printing subsystem — relevant to enterprise Macs where the print service is exposed on the local network.
- CVE-2026-84568 (autofs, High): an authentication bypass in macOS's network volume automounter that could allow root-level code execution via a compromised directory server.
Apple did not report active exploitation of these before the patch. However, functional exploits for well-documented CVEs typically appear publicly within days of a security bulletin — speed of patching matters.
What this means for your privacy
A Bluetooth flaw like CVE-2026-65414 threatens multiple layers of privacy simultaneously. Remote code execution means an attacker could potentially access:
- Messages in iMessage, WhatsApp, or Telegram before on-device encryption applies;
- Saved passwords and private keys in Keychain;
- Photos, documents, and app data;
- Session tokens for banking and payment apps;
- Microphone and camera through system permissions.
CVSS 9+ Bluetooth vulnerabilities in the Apple ecosystem have previously been weaponised in targeted attacks. The LiMP VPN encrypted tunnel protects data in transit — a sensible additional layer, not a substitute for the OS patch, which closes the hole in the Bluetooth code itself.
How to protect yourself right now
Update immediately. On iPhone and iPad: Settings → General → Software Update → iOS/iPadOS 26.7 or 27. On Mac: System Settings → General → Software Update → macOS Tahoe 26.7 or Golden Gate 27. Apple Watch updates automatically once your paired iPhone is updated.
Enable automatic security updates. Under Software Update, turn on Automatic Updates and Security Responses — critical patches will install in the background without manual action.
Until updated, turn off Bluetooth if you don't need it. CVE-2026-65414 exploits the Bluetooth stack. Switching it off in Control Centre removes the attack surface while the update downloads.
Use an encrypted tunnel on untrusted networks. The patch closes the code vulnerability; a VPN closes the network interception gap. LiMP VPN encrypts your connection, hides your real IP, and keeps no logs — layered protection, not an either/or choice.