Apple Patches Over 200 macOS Vulnerabilities
NCSC-NL advisory catalogs 200+ Apple-fixed macOS flaws (Golden Gate 27, Sequoia 15.8, Tahoe 26.7), several critical, enabling RCE, sandbox/Gatekeeper bypass, or privilege escalation.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-65400 as exploited in the wild.
The Dutch National Cyber Security Center (NCSC-NL) published a bulk advisory summarizing a large batch of vulnerabilities that Apple has patched across macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 (the title also references Samba, though no Samba-specific CVEs are enumerated in the body). The bug classes span heap-based buffer overflows, use-after-free conditions, integer overflows, out-of-bounds reads/writes, race conditions, improper access control, argument injection, path traversal, XSS, and missing authorization checks. Several of the listed CVEs carry high CVSS scores (up to 9.8), and per Apple's characterization these issues can lead to unexpected application or system termination, kernel memory corruption, unauthorized access to sensitive user data, sandbox and Gatekeeper bypass, and in some cases remote code execution or denial of service.
The advisory does not indicate any of the listed CVEs are currently being exploited in the wild; it is a standard patch-rollup notification rather than an active-exploitation alert. Given the scale (over 200 CVEs) and the presence of multiple critical/high-severity memory-corruption and privilege-escalation bugs, organizations running affected macOS versions should prioritize applying Apple's updates promptly, particularly on systems exposed to untrusted content or network input where RCE or sandbox-escape chains could be leveraged.
Defenders should track asset inventories for macOS devices on Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, confirm patch deployment through MDM, and monitor for post-patch anomalies (crashes, unexpected privilege changes) that could indicate exploitation attempts predating remediation. No IOCs, malware, or threat-actor attribution are associated with this advisory as it is a vulnerability/patch disclosure rather than an incident report.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0371.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs