[UPDATE] [hoch] Apple macOS: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um seine Privilegien zu erhöhen.
CSIRTS triage
- What
- Multiple vulnerabilities in Apple macOS can be exploited to bypass security measures, conduct Denial of Service attacks, disclose information, manipulate files, and escalate privileges.
- Who is affected
- Users of Apple macOS are affected by these vulnerabilities.
- Urgency
- Remediation is urgent due to the high severity of the vulnerabilities and potential for exploitation.
- Action
- Users should apply the latest updates to macOS.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch macOS
Get an email when a new macOS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0853
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-288600.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-206960.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-145240.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-557530.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2025-580981.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 71% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-597750.82% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-645050.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-650820.81% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-662000.65% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-206070.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [hoch] Apache HTTP Server: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apple iOS: Mehrere Schwachstellencert-bund
- highexploited[UPDATE] [hoch] Apple macOS Tahoe, Sequoia und Sonoma: Mehrere Schwachstellencert-bund
- unknownMultiples vulnérabilités dans les produits VMware (07 septembre 2026)cert-fr-avis
- medium[UPDATE] [mittel] cURL: Mehrere Schwachstellencert-bund
- medium[UPDATE] [mittel] libpng: Mehrere Schwachstellencert-bund
- highCVE-2025-59775: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRFmsrc
- medium[UPDATE] [medium] Xerox FreeFlow Print Server: Multiple vulnerabilities allow unspecified attackcert-bund
- high[NEW] [high] Dell PowerProtect Data Domain: Multiple vulnerabilitiescert-bund
Recent advisories for Apple macOS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0371 [1.00] [M/H] Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en Sambancsc-nl · 2026-09-15
- high[NEU] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstell…cert-bund · 2026-09-15
- high[UPDATE] [hoch] Apple Safari, macOS, iOS und iPadOS: Mehrere Schwachstellencert-bund · 2026-09-15
- high[UPDATE] [hoch] Apple macOS (Tahoe, Sonoma und Sequoia): Mehrere Schwachstellencert-bund · 2026-09-15
- unknownCVE-2026-84601: A permissions issue was addressed with improved state management. This issue is fixed in macOS…nvd · 2026-09-14
- unknownCVE-2026-28836: A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14…nvd · 2026-09-14
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff2026-09-15
- high[NEU] [hoch] MISP: Mehrere Schwachstellen2026-09-15
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service oder unspezifischer Angri…2026-09-15