macOS 27.0.1 Golden Gate Update: What's Confirmed So Far

An OpenCVE entry lists macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1 as the fixed versions for CVE-2026-86950, an out-of-bounds write bug that could let a maliciously crafted file trigger arbitrary code execution. Apple released macOS Golden Gate 27.0.1 on September 28, but its security-releases page says the update has no published CVE entries. OpenCVE's record for CVE-2026-86950 does not list a macOS 27 version, so the public records checked here do not tie CVE-2026-86950 to Golden Gate 27.0.1.

The same OpenCVE entry references a report that the bug "may have been exploited in an extremely sophisticated attack against specific targeted individuals," but it scopes that warning to versions of iOS before iOS 27, not macOS.

Here's what the record establishes about the Sequoia and Tahoe fixes, what remains undocumented about CVE-2026-86950 on Golden Gate, and what that means for anyone deciding whether to update right now.

What's confirmed for Sequoia 15.8.1 and Tahoe 26.7.1

OpenCVE's version data for CVE-2026-86950 sets two boundaries: versions below 15.8.1 are marked affected on macOS Sequoia, and versions below 26.7.1 are marked affected on macOS Tahoe. In both cases, the version named as the boundary is also listed as the fix. That's the record's classification, not an independently verified exposure count, but it's the clearest data point available.

The flaw itself is described as an out-of-bounds write, addressed through improved bounds checking. The listed risk is that processing a maliciously crafted file may lead to arbitrary code execution. The entry doesn't name the file types, apps, or system component involved, so it's unclear which everyday actions — opening a document, previewing an image, downloading an attachment — carry the risk. That's a gap in the public record, not a reason to assume the danger is either broad or narrow.

The same fix is listed for iOS 26.7.1 and iPadOS 26.7.1 alongside the two Mac builds. Whether that means all four platforms share the vulnerable code, or simply shipped patches in the same cycle, isn't something the entry explains.

According to OpenCVE, Apple is aware of a report that the flaw may have been used against targeted individuals, and the record scopes that specifically to iOS versions before iOS 27. It doesn't extend the warning to macOS, and it doesn't rule out macOS exploitation either. The record simply doesn't address it.

Checking which build a Mac is running takes two steps: Apple menu → About This Mac shows the installed version, and System Settings → General → Software Update shows what update, if any, Apple is currently offering for that Mac. For Macs that remain on Sequoia or Tahoe, OpenCVE lists 15.8.1 and 26.7.1, respectively, as the fixed versions.

Evidence at a glance

• macOS Sequoia

  • Open CVE version status: Below 15.8.1 marked affected

  • What's confirmed: 15.8.1 listed as the fix

  • What remains unknown: Which file types or apps trigger the flaw

• macOS Tahoe

  • Open CVE version status: Below 26.7.1 marked affected

  • What's confirmed: 26.7.1 listed as the fix

  • What remains unknown: Whether Tahoe and Sequoia share the vulnerable component

• iOS / iPadOS

  • Open CVE version status: 26.7.1 listed as fixed alongside macOS

  • What's confirmed: Same CVE patched in the same cycle

  • What remains unknown: Whether exploitation applies beyond pre-iOS 27 versions

• macOS 27 Golden Gate

  • Open CVE version status: Not listed in either column

  • What's confirmed: Golden Gate exists as Apple's current release

  • What remains unknown: Whether any Golden Gate build addresses CVE-2026-86950

Why Golden Gate's status stays unresolved, and what to do now

Apple's own support page confirms macOS 27 Golden Gate as the current major release of the Mac operating system and lists which Mac models can install it, based on a page published about two weeks ago. That page identifies Golden Gate and its compatible Macs, but it doesn't supply CVE-specific security-content detail, at least not in what was reviewed for this article.

Zero Day Initiative's review, published 13 days ago, places macOS 27 Golden Gate inside Apple's broader September security release, a cycle that covered ten platforms and totaled 273 CVEs. ZDI breaks that total down further: 134 of those CVEs carry an assigned severity score, and 139 remain unscored; among the scored issues, the firm counts 2 critical, 46 high, 84 medium, and 2 low severity bugs. CVE-2026-86950 isn't broken out individually in that scoring table, so where it falls relative to the rest of September's Apple patches isn't established by that source either.

Apple now lists macOS Golden Gate 27.0.1 as released Sept. 28 and says the update has no published CVE entries. Neither Apple's current security-release listing nor OpenCVE's CVE-2026-86950 record identifies Golden Gate 27.0.1 as a fix for this vulnerability.

Neither Apple's compatibility page nor ZDI's cycle review names a macOS 27.0.1 build, confirms it has shipped, or states whether it addresses CVE-2026-86950. That's a documentation gap in the sources checked here, not evidence that Golden Gate shipped unpatched, and not evidence the flaw was already closed before Golden Gate's release either. Golden Gate's status on this specific CVE sits as an open question rather than a confirmed risk or a confirmed fix.

Owners running Sequoia below 15.8.1 or Tahoe below 26.7.1 have a documented fix tied to this CVE, according to OpenCVE's version data, and should check whether Software Update is offering it. That part of the record is settled.

For macOS 27 Golden Gate, Apple confirms that 27.0.1 shipped September 28, but its security-release listing contains no published CVE entries for that update, and the CVE-2026-86950 record does not name a Golden Gate release.