Apple Patches Over 200 macOS Vulnerabilities

NCSC-NL advisory catalogs 200+ Apple-fixed macOS flaws (Golden Gate 27, Sequoia 15.8, Tahoe 26.7), several critical, enabling RCE, sandbox/Gatekeeper bypass, or privilege escalation.

The Dutch National Cyber Security Center (NCSC-NL) published a bulk advisory summarizing a large batch of vulnerabilities that Apple has patched across macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 (the title also references Samba, though no Samba-specific CVEs are enumerated in the body). The bug classes span heap-based buffer overflows, use-after-free conditions, integer overflows, out-of-bounds reads/writes, race conditions, improper access control, argument injection, path traversal, XSS, and missing authorization checks. Several of the listed CVEs carry high CVSS scores (up to 9.8), and per Apple's characterization these issues can lead to unexpected application or system termination, kernel memory corruption, unauthorized access to sensitive user data, sandbox and Gatekeeper bypass, and in some cases remote code execution or denial of service.

The advisory does not indicate any of the listed CVEs are currently being exploited in the wild; it is a standard patch-rollup notification rather than an active-exploitation alert. Given the scale (over 200 CVEs) and the presence of multiple critical/high-severity memory-corruption and privilege-escalation bugs, organizations running affected macOS versions should prioritize applying Apple's updates promptly, particularly on systems exposed to untrusted content or network input where RCE or sandbox-escape chains could be leveraged.

Defenders should track asset inventories for macOS devices on Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, confirm patch deployment through MDM, and monitor for post-patch anomalies (crashes, unexpected privilege changes) that could indicate exploitation attempts predating remediation. No IOCs, malware, or threat-actor attribution are associated with this advisory as it is a vulnerability/patch disclosure rather than an incident report.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0371.html