[UPDATE] [hoch] Apple iOS und iPadOS: Mehrere Schwachstellen

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-09-09

Exploitation

Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1459

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-436700.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-653670.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-18370.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
• Moderate exploitation riskCVE-2026-288197.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 94% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288460.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288470.60% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288700.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288720.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288730.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-288770.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Referenced CVEs

+12 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownNCSC-2026-0371 [1.00] [M/H] Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en Sambancsc-nl
• unknownNCSC-2026-0370 [1.00] [M/H] Kwetsbaarheden verholpen in Apple iOS en iPadOSncsc-nl
• high[NEU] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstell…cert-bund
• high[UPDATE] [hoch] Apple Safari, macOS, iOS und iPadOS: Mehrere Schwachstellencert-bund
• high[UPDATE] [hoch] Apple macOS (Tahoe, Sonoma und Sequoia): Mehrere Schwachstellencert-bund
• unknownApple Products Multiple Vulnerabilitieshkcert
• high[UPDATE] [hoch] Apple iOS: Mehrere Schwachstellencert-bund
• high[UPDATE] [high] WebKitGTK: Multiple vulnerabilitiescert-bund
• unknownUSN-8703-1: WebKitGTK vulnerabilitiesubuntu
• mediumCVE-2026-65367: A null pointer dereference was addressed with improved input validation. This issue is fixed i…nvd
• highCVE-2026-43670: A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet conte…nvd
• unknownNCSC-2026-0319 [1.00] [M/H] Vulnerabilities resolved in Apple iOS and iPadOSncsc-nl

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service2026-09-15
• high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-15
• high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff2026-09-15
• high[NEU] [hoch] MISP: Mehrere Schwachstellen2026-09-15
• medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service oder unspezifischer Angri…2026-09-15