Multiples vulnérabilités dans les produits Apple (15 septembre 2026)
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1172/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-289300.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEU] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstell…cert-bund
- high[UPDATE] [hoch] Apple Safari, macOS, iOS und iPadOS: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apple macOS (Tahoe, Sonoma und Sequoia): Mehrere Schwachstellencert-bund
- unknownApple Products Multiple Vulnerabilitieshkcert
- unknownCVE-2026-86905: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iP…nvd
- unknownCVE-2026-86902: A parsing issue in the handling of directory paths was addressed with improved path validation…nvd
- unknownCVE-2026-86890: A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 2…nvd
- unknownCVE-2026-86887: A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and …nvd
- unknownCVE-2026-86886: A path traversal issue was addressed with improved input validation. This issue is fixed in iO…nvd
- unknownCVE-2026-86885: An input validation issue was addressed with improved input validation. This issue is fixed in…nvd
- mediumCVE-2026-86879: A denial-of-service issue was addressed with improved input validation. This issue is fixed in…nvd
- unknownCVE-2026-84635: A logic issue was addressed with improved state management. This issue is fixed in Safari 27, …nvd
More from CERT-FR Avis de sécurité
- unknownMultiples vulnérabilités dans Microsoft Edge (15 septembre 2026)2026-09-15
- unknownMultiples vulnérabilités dans les produits Cisco (15 septembre 2026)2026-09-15
- unknownVulnérabilité dans Microsoft Windows (15 septembre 2026)2026-09-15
- unknownMultiples vulnérabilités dans Squid (14 septembre 2026)2026-09-14
- unknownMultiples vulnérabilités dans MongoDB (14 septembre 2026)2026-09-14