CVE-2026-43816
An out-of-bounds write in the kernel, fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, watchOS 26.6, tvOS 26.6 and visionOS 26.6.
Muneeb Amin Bhat is among the researchers Apple credits.
300+ vulnerabilities reported since 2022
Muneeb Amin Bhat’s research, from an Oracle CVE in 2022 to the company he opened in August 2026.
Halls of fame and bounties
- NVIDIA
- SimScale
- Oracle(opens in a new tab)
- Kraken
- Apple(opens in a new tab)
- USAA
- Indeed
- NASA
- FFmpeg
- Vercel
- Acronis
- Lightspark
- Anthropic
- Nextcloud
- McDonald’s
- Fireblocks
- AXIS OS
- Zendesk
- Binance
- Asana
Web3: audits and rewards
- VeChainThor
- Multipli Smart Contracts
- Internet Computer Protocol (ICP)
- Snowbridge On-Chain Code
- Olas
- Injective Peggy Bridge
Where I hunt
Deep in the stack or out on the open web, the job is the same: find what breaks, prove it, report it.
Operating-system kernels
The core of the operating system. A bug there reaches everything above it.
- Apple CVE-2026-43816
Enterprise software
Business suites that hold a company’s money, staff and data.
- Oracle E-Business Suite CVE-2022-21500
- Zendesk
- Asana
Secure firmware
Code that runs before the operating system, where trust starts.
- Arm Trusted Firmware Accepted and rewarded
Web and cloud
Servers, APIs and the cloud behind them.
- Apple web servers 2023
- NASA VDP Hall of Fame 2024
Finance and fintech
Banks, exchanges and payments, where a bug touches real money.
- USAA
- Kraken
- Binance
- Fireblocks
- Lightspark
Web3 and smart contracts
Chains, bridges and the contracts on them, where the code is the vault.
- VeChainThor
- Multipli Smart Contracts
- Internet Computer Protocol (ICP)
- Snowbridge On-Chain Code
- Olas
- Injective Peggy Bridge
AI
New systems, and new ways for them to fail.
- Anthropic
Open source and self-hosted
Code anyone can read, run by people on their own servers.
- FFmpeg
- Nextcloud
Consumer platforms
The apps people open every day.
- Indeed
- McDonald’s
Year by year
First reports
Starts hunting on bug bounty and disclosure programs.
CVE-2022-21500, credited by Oracle
Oracle E-Business Suite. CVSS 3.1 base score 7.5.
Sourcefor CVE-2022-21500, credited by Oracle (opens in a new tab)Apple Web Server Security Acknowledgements
Listed for reports on Apple’s web servers.
Sourcefor Apple Web Server Security Acknowledgements (opens in a new tab)First press, at home
Daily Excelsior, Kashmir Life and Greater Kashmir cover the Apple listing.
Sourcefor First press, at home (opens in a new tab)NASA VDP Hall of Fame
WION, on prime time
WION runs the NASA story online and on Gravitas. ANI, DNA India and ABP Live follow.
Sourcefor WION, on prime time (opens in a new tab)The Hindu BusinessLine feature
His reports to Apple, NASA and Google, online and in print.
Sourcefor The Hindu BusinessLine feature (opens in a new tab)NITI Aayog Frontier Tech Hub
Profiled in “Guardians of the Grid”.
Sourcefor NITI Aayog Frontier Tech Hub (opens in a new tab)Firmware findings rewarded by Arm
Accepted and rewarded in the Trusted Firmware scope.
CVE-2026-43816, credited by Apple
A kernel out-of-bounds write, fixed in iOS 26.6 and macOS Tahoe 26.6.
Sourcefor CVE-2026-43816, credited by Apple (opens in a new tab)Vulnara Technologies opens
MSME registered, Udyam UDYAM-JK-11-0024606.
300+vulnerabilities reported
The count as of September 2026, since 2022.
CVEs with his name on them
CVE-2022-21500
CVSS 3.1 base score 7.5, from Oracle’s own Security Alert. The alert credits him as “Bhat Muneeb”.
Oracle Security Alert(opens in a new tab)Inside Arm’s Trusted Firmware
In 2026 Arm’s bug bounty program accepted and rewarded his findings in its Trusted Firmware scope.
Firmware and IoT testingListed and thanked
Apple: Web Server Security Acknowledgements (opens in a new tab)
Web Server Security AcknowledgementsAcknowledgement
August 2023
NASA
Vulnerability Disclosure Program Hall of FameHall of fame
2024
Indeed
Hall of Fame
USAA
Hall of Fame
Acronis
Bug bounty programAcknowledgement
Anthropic
Security programAcknowledgement
Lightspark
Bug bounty programAcknowledgement
Stories behind the record
Apple
Apple, and the first headlines
In August 2023 Apple listed me in its Web Server Security Acknowledgements. Back home, Daily Excelsior reported the find as an iCloud issue that exposed user data. It was my first time in the papers.
NASA
NASA’s hall of fame
In 2024 NASA added me to its Vulnerability Disclosure Program Hall of Fame. ABP Live reported it was for data breach vulnerabilities. WION ran the story on prime time, ANI put it on video, and outlets across India followed.
Arm and Apple
Down to the kernel
In 2026 Arm’s bug bounty program accepted and rewarded my findings in Trusted Firmware. In July Apple credited me for CVE-2026-43816, a kernel out-of-bounds write. A month later I opened Vulnara.
From Kashmir to the world
I work from Kulgam, in south Kashmir. My reports land with security teams in the US, the UK and Germany.
KulgamtoUnited States
Apple, Google, NASA, NVIDIA, USAA, Indeed, Kraken, Vercel, Lightspark, Anthropic, Oracle, McDonald’s, Pinterest, Zendesk, Asana and Fireblocks
KulgamtoUnited Kingdom
Arm
KulgamtoGermany
SimScale and Nextcloud
KulgamtoIndia
NITI Aayog
Profiled by NITI Aayog
In 2025 the Government of India’s policy think tank put him in a Frontier Tech Hub story on young Indians in cyber security.
Guardians of the Grid: 7 Young Indians Fortifying Our Cyber Frontiers
On camera
When NASA listed me, the story made it to TV.
- “Gravitas: Kashmiri techie makes it to NASA’s ‘hall of fame’”, 15 May 2024.(opens in a new tab)
- “Meet Muneeb Amin Bhat from South Kashmir, who has made entry into NASA’s ‘Hall of Fame’”, 23 May 2024.(opens in a new tab)
- “Meet Muneeb Amin Bhat from South Kashmir, who has made entry into NASA’s ‘Hall of Fame’”, 23 May 2024.(opens in a new tab)
In the press
- WION“Kashmiri techie makes it to NASA’s ‘hall of fame’”(opens WION in a new tab)
- The Hindu BusinessLinePrint, Bangalore edition“Valley youth gatekeeps for Apple, NASA & Google”(opens The Hindu BusinessLine in a new tab)
- ANIVideo, News agency“Meet Muneeb Amin Bhat from South Kashmir, who has made entry into NASA’s ‘Hall of Fame’”(opens ANI in a new tab)
- The Better IndiaWeb storyWeb story on his recognition from Apple and NASA(opens The Better India in a new tab)
- Zee News“Kashmiri Techie Enters NASA’s Hall of Fame For Cybersecurity Achievements”(opens Zee News in a new tab)
- Greater Kashmir“Kulgam youth earns spot in NASA’s Hall of Fame”(opens Greater Kashmir in a new tab)
All coverage
International
National
- The Hindu BusinessLine“Apple, NASA, Google: A young Kashmiri boy helps in safeguarding digital giants”(opens The Hindu BusinessLine in a new tab)
- The Better IndiaFeature on hall of fame recognition from NASA and Apple(opens The Better India in a new tab)
- The Hindu BusinessLineVideo, ANI video“Meet Muneeb Amin Bhat from South Kashmir, who has made entry into NASA’s ‘Hall of Fame’”(opens The Hindu BusinessLine in a new tab)
- India Blooms News ServiceCredited to WION“Kashmiri techie wins NASA’s ‘Hall of Fame’ after spotting data breach vulnerabilities”(opens India Blooms News Service in a new tab)
- InshortsSummaryNews summary of the NASA Hall of Fame listing(opens Inshorts in a new tab)
- Indiatimes“Who is Muneeb Amin Bhatt? After Apple Now The Indian Techie Entered NASA’s ‘Hall of Fame’”(opens Indiatimes in a new tab)
- DNA IndiaReport on the NASA Hall of Fame listing, after earlier recognition from Apple(opens DNA India in a new tab)
- ABP Live“J&K: Kulgam Techie Earns NASA ‘Hall Of Fame’ Spot After Identifying Data Breach Vulnerabilities”(opens ABP Live in a new tab)
Jammu and Kashmir
- Free Press KashmirInterview“Bounties and Breaks: ‘Hall of Fame’ rise of a Kashmiri ethical hacker”(opens Free Press Kashmir in a new tab)
- Kashmir LifeBriefingWeekly briefing item on the NASA Hall of Fame listing(opens Kashmir Life in a new tab)
- Rising KashmirReport on the NASA and Apple hall of fame recognition(opens Rising Kashmir in a new tab)
- Daily Excelsior“After Apple, Kulgam techie enters NASA’s ‘Hall of Fame’”(opens Daily Excelsior in a new tab)
- Greater Kashmir“Kulgam youth makes it to Apple Hall of Fame”(opens Greater Kashmir in a new tab)
- Kashmir Life“Kashmiri Prodigy Earns Coveted Spot in Apple’s Hall of Fame”(opens Kashmir Life in a new tab)
- Kashmir News Observer“Kulgam’s Tech prodigy enters Apple’s ‘Hall Of Fame’ for uncovering critical data vulnerability”(opens Kashmir News Observer in a new tab)
- Daily Excelsior“Kulgam techie enters Apple ‘Hall of Fame’ for data leak find”(opens Daily Excelsior in a new tab)
- CNI“Kulgam techie enters Apple ‘Hall of Fame’ for data leak find”(opens CNI in a new tab)
Tell us what to break. Or what to build.
Send the scope and your deadline, and we’ll set up a call.