CVE-2026-65414: Apple Bluetooth Flaw Scores CVSS 9.8

CVE-2026-65414 is an out-of-bounds write in Apple's Bluetooth stack, patched across nearly every current Apple platform on September 14, 2026, as part of one of Apple's largest coordinated security releases to date (273 distinct CVEs across ten advisories). It carries a CVSS score of 9.8, and the CVSS vector lists the attack vector as Network. Apple has not indicated it was exploited in the wild, and there is no known exploit on record. Read the score alone and this sits in the same bucket as an internet-facing zero-day. Read the mechanism, and it tells a different story.

What the vulnerability is

The flaw sits in Apple's Bluetooth component and is tracked under CWE-787 (Out-of-bounds Write). Apple's own description is characteristically brief: "An out-of-bounds write issue was addressed with improved bounds checking." The listed impact is that a remote attacker may be able to cause unexpected app termination or arbitrary code execution, with no user interaction required.

Here is the part worth slowing down on. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores the attack vector as Network, the same category assigned to an internet-facing web service. But the vulnerable code lives in the Bluetooth stack, and Bluetooth does not route over the internet. Triggering a Bluetooth stack bug generally means an attacker has to be within wireless range of the target, or otherwise get malicious Bluetooth traffic in front of the device, a different threat model than "reachable from anywhere." CVSS's Network label describes the protocol layer at which the flaw is exploited, not the physical distance an attacker has to close, and that distinction disappears the moment someone reads "9.8, Network" and pictures an open port on the internet.

Who is affected

Apple shipped the fix across essentially its whole current lineup at once: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. For iOS and iPadOS specifically, Apple lists the fix as available for iPhone 11 and later, iPad Pro 12.9-inch (4th generation) and later, iPad Pro 11-inch (2nd generation) and later, iPad Air (4th generation) and later, iPad 9th generation and later, and iPad mini (6th generation) and later. Other platforms carry their own device lists in Apple's respective advisories. If a device has Bluetooth hardware and runs an affected OS build, it is in scope, this is not something you can configure your way out of without disabling Bluetooth entirely.

Network on paper, proximity in practice

This is a case where the score is honest about severity and silent about exposure. A 9.8 with no known exploitation and no KEV listing does not mean "not urgent." Out-of-bounds write bugs requiring no user interaction have a track record of turning into working exploits once someone puts time into them, and VulnTracker's SSVC read flags this one as Automatable, meaning a working exploit could plausibly be scripted and repeated rather than requiring bespoke effort per target. What the score does not tell you is who has to be near a device, on what channel, before any of that risk becomes real.

For most organizations, the exposure question here is not "am I on an affected iOS or macOS build," almost everyone is. It is whether Bluetooth stays enabled on devices that move through public or unmanaged spaces: laptops in coffee shops, phones at conferences, shared or kiosk devices left with Bluetooth on by default. That is a genuinely different prioritization question than "is this reachable from the internet," and it is exactly the kind of nuance a CVSS number, by design, cannot carry on its own.

Reading it on VulnTracker

On VulnTracker, CVE-2026-65414's page shows the CVSS 9.8 CRITICAL score next to the SSVC markers (No known exploit, Automatable, Total impact) and an EPSS estimate of 1.0 percent, useful context for a flaw with no confirmed exploitation yet. The Affected Platforms panel breaks out iOS, iPadOS, macOS, tvOS, visionOS, and watchOS as separate entries with their own version cutoffs, and the Affected Products list covers all five platform families in one place instead of across ten separate Apple bulletins. The remediation panel points straight to Apple's own per-platform advisories rather than a single generic "update your device" line.

What to do

Update affected devices to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27, whichever applies. Because this shipped inside Apple's regular update mechanism rather than an emergency out-of-band patch, standard device management timelines apply, but given the CVSS score and the Automatable SSVC flag, it belongs near the top of your normal patch cycle rather than the back of it.

Since there is no confirmed exploitation to hunt for, the higher-value action is exposure reduction rather than log review: inventory which managed devices run with Bluetooth enabled by default, prioritize rollout for devices that regularly operate in public or unmanaged physical spaces, and use this as a prompt to reconsider whether Bluetooth needs to be on by default across the fleet at all. Mobile device management push updates and compliance checks are the more useful lever here, since Apple has not published, and this release did not include, any indicators of compromise to search for.

Takeaway

CVE-2026-65414 scores exactly as high as an internet-facing critical RCE, and reads nothing like one once you check where the vulnerable code actually lives. A CVSS 9.8 with attack vector Network on a Bluetooth stack bug is a reminder that the vector field describes a protocol layer, not a distance, and the gap between those two readings is exactly where a good prioritization call gets made.

If you manage Apple devices at scale, sign up at vulntracker.io to track CVE-2026-65414 across your fleet's actual OS versions and see how VulnTracker's affected-platform data maps to what you are really running.

References: Apple: About the security content of iOS 27 and iPadOS 27 · NVD, CVE-2026-65414 · Cyber Security News: Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices