The Apple security updates released on 14 September are bigger than a single operating-system update. Ten separate advisories cover iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari and Xcode. Across them, Apple lists 1,038 product-level CVE references. Remove the overlap created by shared components and the result is 273 unique vulnerability identifiers. That is an unusually large attack-surface reset. It is also a number that needs careful handling. Apple did not describe all 273 vulnerabilities as critical, and the total is not a count of 273 newly discovered zero-days. The advisories include everything from privacy and information-disclosure flaws to denial-of-service conditions, sandbox escapes, kernel-level code execution and remote attack paths. One entry makes the release more urgent than the headline alone suggests. CVE-2026-65400, an authentication bypass in the macOS Screen Sharing Server, is already in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue. It predates this release and was addressed in earlier Apple updates, but it appears again in Apple’s new macOS release advisories. That matters because a fresh operating-system rollout can contain both newly disclosed flaws and known attack paths that organisations may still not have remediated across their estates. The 273 figure is real, but it is not the whole story BlackTree independently counted the CVE identifiers in Apple’s ten official advisories. The per-advisory totals add up to 1,038 references, because the same vulnerability can affect several products built on shared frameworks. Deduplicating those references produces 273 unique CVEs. Apple advisoryUnique CVEs listed…