Security Independently confirmed 2 publishers 2 min read Published Sep 16, 2026, 3:30 AM PDT

Deferring iOS 27 leaves about 56 of its 126 fixes out of the 26.7 build

Apple's September 14 releases close 273 unique vulnerabilities across ten advisories, with no exploitation reported. Fleet managers have to pick which lane to patch on, and the 26.7 build leaves out about 56 of the fixes that ship in iOS 27.

The Watch · Security desk

Send a correction

Illustration accompanying Deferring iOS 27 leaves about 56 of its 126 fixes out of the 26.7 build — Generated illustration

What happened

Apple pushed security updates on September 14, 2026 across iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari and Xcode, covering both the 27 major releases and the 26.7 and 15.8 minor builds.
macOS Golden Gate 27 took the largest share of the batch at 210 CVEs, followed by macOS Sequoia 15.8 at 154 and macOS Tahoe 26.7 at 153, according to The Cyber Express.
The fixes touch more than 90 platform components, among them AppleKeyStore, Authentication Services, Foundation, Safe Browsing, Sandbox, Security, TCC and WebKit.
Apple did not say any of the patched flaws had been exploited in the wild.
iPhone owners see iOS 26.7 offered prominently in Settings with iOS 27 as a secondary option, a structure Apple keeps for months after a major release.

Why it matters

Who's exposed exposure Any Mac with Screen Sharing reachable from the network belongs at the top of the inventory, because the pre-patch flaw there, CVE-2026-65400, gets past login credentials remotely.
What it costs cost Apple's staged rollout can take days or weeks to reach every device, so closing that window early costs manual or managed installs instead of waiting on automatic updates.
What doesn't add up contradiction SecurityWeek counted more than 200 fixes and called the batch a record, while The Cyber Express consolidated the same advisories to 273 unique flaws, so a patch-coverage number reported to management needs its source named.
What it limits constraint The minor lane runs on iPhone 11 and later, so the option to sit out iOS 27 exists only for devices Apple still serves with 26.7.

Next story · Product · yesterday

Apple Invites 1.12.1 gives hosts an easier way to log RSVPs that arrive outside the app

Confirmed2 publishers

Ten advisories list the same bugs more than once. Consolidated, 1,038 product-level CVE entries come down to 273 distinct flaws ^[2]^[3], an average of 3.8 listings per flaw ^[24], because a fix in a shared framework ships in every operating system that carries that framework ^[3].

The gap between the two iPhone lanes is countable. iOS 27 and iPadOS 27 fix about 126 flaws, 20 of them in the kernel, according to SecurityWeek ^[11]. iOS 26.7 and iPadOS 26.7 fix more than 80, about 70 of which are also in the 27 build ^[7]. Subtract: roughly 56 of iOS 27's fixes are absent from 26.7, or about 44 percent of the major release's count ^[25]. Around ten of 26.7's fixes do not appear on the iOS 27 list at all ^[26].

The desktop split is narrower. More than 140 of macOS Sequoia 15.8's fixes are also in macOS Tahoe 26.7 ^[8], and Tahoe includes 26 kernel defects that could lead to memory corruption, privilege escalation, system termination and information leaks ^[6]. Roughly 100 of macOS Golden Gate 27's fixes are shared with iOS 27 ^[5].

On the phone, iOS 26.7 closes 16 kernel-level flaws, the most severe being CVE-2026-43689, which could have given a malicious app root, per The Cyber Express ^[18]. A race condition in AVEVideoEncoder, CVE-2026-84607, could have let a sandboxed app run code with kernel privileges ^[17]. Bluetooth had an out-of-bounds write, CVE-2026-65414, that could have let a remote attacker crash an app or run code ^[16]. And in WebKit, a use-after-free, CVE-2026-43715, could have corrupted memory through crafted web content ^[19].

Safari 27 took six fixes, one of them for cross-site scripting delivered through a malicious webarchive ^[10]. tvOS 27, watchOS 27 and visionOS 27 each got dozens of patches, and Xcode 27 got one ^[9].

The macOS update also closes CVE-2022-3437, a medium-severity heap-based buffer overflow in Samba within Heimdal that can cause denial of service, an identifier four years older than the rest of the batch ^[14]^[27].

What to watch

Whether Apple backports the roughly 56 iOS 27-only fixes into a 26.7.x release or leaves the gap until fleets move.
An amendment to any of the ten advisories flagging in-the-wild use of one of these CVEs.
Public exploit work on CVE-2026-65400, the Screen Sharing Server credential bypass. That would change the urgency for Macs with the service exposed.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence74
Adoption55
Hype gap+18
Incentives40
Confidence72

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
On September 14, 2026, Apple pushed updates across nearly its entire product line, including iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari and Xcode, through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27, plus iOS and iPadOS 26.7, macOS Tahoe 26.7 and macOS Sequoia 15.8.
Reported SupportedView cited source
[2]
In total the Apple security update resolves 273 unique vulnerabilities.
Reported SupportedView cited source
[3]
The 273 figure comes from consolidating 1,038 product-level CVE entries spread across ten separate advisories, since many flaws sit in shared frameworks and therefore show up in multiple operating systems at once.
Reported SupportedView cited source
[4]
macOS Golden Gate 27 accounts for the largest share with 210 CVEs, followed by macOS Sequoia 15.8 at 154 and macOS Tahoe 26.7 at 153.
Reported SupportedView cited source
[5]
macOS Golden Gate 27 addresses 210 vulnerabilities, roughly 100 of which are shared with the iOS 27 release.
Reported SupportedView cited source
[6]
macOS Tahoe 26.7 patches 153 unique CVEs, including 26 security defects in the kernel that could lead to memory corruption, privilege escalation, system termination and information leaks.
Reported SupportedView cited source
[7]
Apple rolled out iOS 26.7 and iPadOS 26.7 with patches for over 80 vulnerabilities, including approximately 70 also resolved in iOS 27 and iPadOS 27.
Reported SupportedView cited source
[8]
macOS Sequoia 15.8 shipped with over 150 patches, more than 140 of which are also found in macOS Tahoe 26.7.
Reported SupportedView cited source
[9]
Apple released tvOS 27, watchOS 27 and visionOS 27 with patches for dozens of security flaws each, Safari 27 with six fixes, and Xcode 27 with one patch.
Reported SupportedView cited source
[10]
Safari 27 patched six CVEs, including one letting cross-site scripting attacks run via a malicious webarchive and another risking data exposure during web-content processing.
Reported SupportedView cited source
[11]
iOS 27 and iPadOS 27 include fixes for about 126 security flaws, 20 of which affect the kernel.
Reported SupportedView cited source
[12]
The fixes target more than 90 platform components, including AppleKeyStore, Authentication Services, Foundation, Safe Browsing, Sandbox, Security, TCC and WebKit.
Reported SupportedView cited source
[13]
Apple makes no mention of any of these security defects being exploited in the wild.
Reported SupportedView cited source
[14]
While the vast majority of the issues were discovered in 2026, the macOS update also fixes CVE-2022-3437, a medium-severity heap-based buffer overflow in Samba (within Heimdal) that could lead to denial-of-service attacks.
Reported SupportedView cited source
[15]
A Screen Sharing Server flaw, CVE-2026-65400, could have let attackers bypass login credentials over a network.
Reported SupportedView cited source
[16]
CVE-2026-65414 is an out-of-bounds write in Bluetooth that could have let a remote attacker crash an app or run malicious code.
Reported SupportedView cited source
[17]
CVE-2026-84607, a race condition in AVEVideoEncoder, could have allowed a sandboxed app to execute code with kernel-level privileges.
Reported SupportedView cited source
[18]
iOS 26.7 closes 16 kernel-level vulnerabilities, the most severe being CVE-2026-43689, which could have granted a malicious app root access.
Reported SupportedView cited source
[19]
iOS 26.7 also fixes five ImageIO bugs and a WebKit use-after-free flaw, CVE-2026-43715, capable of corrupting memory through crafted web content.
Reported SupportedView cited source
[20]
iPhone owners see iOS 26.7 offered prominently in Settings, with iOS 27 listed as a secondary option, a structure Apple maintains for months after a major release.
Reported SupportedView cited source
[21]
iOS 26.7 supports iPhone 11 and later, along with a range of iPad Pro, iPad Air, iPad and iPad mini models.
Reported SupportedView cited source
[22]
Apple's staged rollout can take days or weeks to reach every device, so security specialists suggest installing iOS 26.7 manually via Settings > General > Software Update.
Reported SupportedView cited source
[23]
SecurityWeek reported that Apple announced patches for a record number of vulnerabilities, including more than 200 flaws patched with iOS 27 and macOS Golden Gate 27.
Reported SupportedView cited source
[24]
The 1,038 product-level CVE entries average about 3.8 listings per unique flaw.
Derived Supported
[25]
About 56 of iOS 27's roughly 126 fixes are not in iOS 26.7, about 44 percent of the major release's count.
Derived Supported
[26]
About ten of the fixes in iOS 26.7 are not among those resolved in iOS 27.
Derived Supported
[27]
CVE-2022-3437 carries an identifier four years older than the 2026 releases that fix it.
Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

securityweek.com
1 article · September 15, 2026
Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
thecyberexpress.com
1 article · September 15, 2026
Apple Patches 273 Vulnerabilities as iOS 26.7 Rolls Out

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

The two accounts sit at different levels of the same advisory set. SecurityWeek counts by release and by overlap; The Cyber Express counts by unique flaw and then names them. For anyone maintaining code against Apple frameworks, the useful detail is spread across both: SecurityWeek's list of more than 90 affected components, including AppleKeyStore, Authentication Services, Sandbox, Security, TCC and WebKit, and The Cyber Express's specific identifiers in Bluetooth, AVEVideoEncoder, CoreMedia, ImageIO and WebKit. Neither source publishes the per-advisory CVE lists behind the 273 figure, so the consolidation cannot be checked from the reporting alone.

Operator

The decision this reporting sets up is which lane to patch on. SecurityWeek's figures are what make it a decision at all: iOS 27 fixes about 126 flaws, iOS 26.7 fixes over 80, and about 70 of those are the same, so deferring the major release leaves roughly 56 fixes unapplied. Around ten 26.7 fixes are not in iOS 27. The Cyber Express notes that Settings shows 26.7 first and iOS 27 second, and that Apple keeps that arrangement for months, which is how a fleet ends up on the shorter list by default. Both sources push toward prompt installation; The Cyber Express says security specialists advise doing it manually because the staged rollout can take days or weeks.

Investor

Nothing here is priced. There is no revenue, guidance, or market figure in either account, and neither source treats the volume as a signal about Apple's engineering costs or product cadence. The only quantity with any commercial reading is Apple's own record framing of the release, reported by SecurityWeek, and that is a security note, not a financial one.