CVE-2026-65414

No known exploitation. EPSS puts it in the 64th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile64th1.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-14Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the operating-system version on every company iPhone, iPad, Mac, Apple TV, Apple Watch, and Vision Pro.
Update iPhone and iPad devices to iOS/iPadOS 26.7 or iOS/iPadOS 27; update Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, as applicable.
Update Apple TV, Apple Watch, and Vision Pro devices to tvOS 27, watchOS 27, and visionOS 27.
Record devices that cannot be updated and keep them off untrusted networks until replacement or vendor-supported remediation is available.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.

In plain language

Written by AI from the record

This is a critical flaw in Apple operating systems; businesses with devices not updated to iOS/iPadOS 26.7 or 27, macOS 15.8/26.7/27, or tvOS, visionOS, or watchOS 27 should act now.

Unauthenticated network-reachable out-of-bounds write (CWE-787) can cause application termination or arbitrary code execution on affected Apple platforms.

If you're affected

Device compromise
Unexpected app crashes
Business app disruption
Sensitive data exposure

What is it

A mistake in how the operating system handles incoming data can let a remote attacker crash an app or potentially take control of code running on the device. It is like a delivery slot that accepts a package too large for its storage area, allowing the overflow to damage nearby controls.

Who is affected

This matters if your business uses Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS. It is especially relevant for company-managed phones, tablets, computers, meeting-room Apple TVs, watches, and headsets that have not received the relevant operating-system update. The risk applies when an attacker can reach the vulnerable service over a network.

How urgent is it

A remotely delivered flaw can enable malicious code to run or cause affected apps to crash, making this a red-priority update. No active exploitation has been confirmed in the available findings, but the severity and lack of an account requirement warrant prompt remediation.

What to do — in detail

Confirm installed versions through device-management inventory or each device's software-update screen, then identify systems below their supported fixed release. Upgrade iOS and iPadOS to 26.7 on that release branch or to 27; upgrade macOS Sequoia to 15.8, macOS Tahoe to 26.7, or macOS Golden Gate to 27. Upgrade tvOS, visionOS, and watchOS to version 27.

Use normal Apple software-update or managed-device deployment procedures and test critical business applications on a representative device before broad rollout where your change process requires it. If an update must be delayed, isolate the device from untrusted networks, restrict unnecessary network access, and prioritize replacement if it cannot run a supported fixed version. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor update-deployment status and investigate unexpected application crashes on affected devices.

Technical context

CVE-2026-65414 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is an out-of-bounds write, CWE-787, reachable through a network attack vector and requiring no authentication or user interaction; reported outcomes are unexpected application termination or arbitrary code execution. CISA KEV does not list this CVE, no clear dated in-the-wild exploitation claim is available, and no public exploit code is on record. EPSS predicts 1.0% likelihood of exploitation, at the 61st percentile, with a flat trend; exploit maturity is not established.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS64th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.1% chance of exploitation activity in the next 30 days, which ranks it in the 64th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2 days, from the signal feeds we watch.

2026-09-16Patch availablerecord updated
2026-09-15Record updatedrecord updated
2026-09-14Publishedweakness classified, att&ck mapped, record updated

Affected products

Applecommercial · USaka apple inc., apple computer
- ipadosOSEmbeddedOperating Systems / mobile-os
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os
- macOSOSOn-premOperating Systems / unix-bsd
- visionOSOSOperating Systems / mobile-os
- watchOSOSEmbeddedOperating Systems / mobile-os
- tvOSOSEmbeddedOperating Systems / mobile-os

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable