CVE-2026-65378 is a high severity (CVSS 7.5 in the record) flaw in macOS where an app may be able to access sensitive user data. Apple fixed it on 14 September 2026 in macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8. Update every Mac to one of those releases.
What's affected
Apple's security notes for the three releases list this CVE with the impact "An app may be able to access sensitive user data". Apple's description is: An authorization issue was addressed with improved state management.
The fixed versions, per the record and the Apple pages, are:
- macOS Golden Gate 27
- macOS Tahoe 26.7
- macOS Sequoia 15.8
Apple lists the component as Spotlight in the Tahoe and Sequoia notes. Apple does not publish a CVSS score or a list of vulnerable older builds, so the 7.5 figure comes from the record. Apple says only that the issue is addressed in the listed releases, and it does not say exploitation has been seen. The record's KEV flag is false.
Older macOS releases that are not in Apple's list are not described by this advisory. Apple does not state whether they are affected, so check the security releases page if you manage older Macs.
How to check if you're exposed
Read the macOS version on each machine. On a single Mac, open About This Mac. For a fleet, query it through your device management tool, or run this in Terminal:
sw_vers -productVersion
softwareupdate --list
The first command prints the version. The second lists updates that are available but not yet installed. A Mac on Tahoe below 26.7, or on Sequoia below 15.8, is behind the fix. For Golden Gate, match the build against the version Apple lists in its security notes.
What to do now
- Pull a list of macOS versions across your managed Macs.
- Update Tahoe machines to 26.7, Sequoia machines to 15.8, and Golden Gate machines to 27.
- Push the update through your device management tool and set a deadline instead of waiting for users to click.
- Review which third party apps your users have installed and remove ones nobody needs. The impact line is about apps reading data they should not see.
- Check the three Apple security notes for other CVEs in the same releases and plan the reboot once.
Why it matters
The weakness class is CWE-863, incorrect authorization. Incorrect authorization means a check exists but reaches the wrong answer, often because the code tracks state badly and decides on stale or incomplete information. Apple says the fix is improved state management, which suggests the decision was made against state that did not match reality.
Apple's wording for this class of fix is terse, and that is normal for the vendor. The practical point is that the attacker is an app already on the Mac, so the risk grows with how many apps your users run and how freely they install them. Keeping the OS current is the control you own.
Quick check
Do I need to do anything if auto updates are on?
Confirm it. Auto update can lag or be paused by policy, so read the installed version and compare it with 26.7, 15.8 or 27.
Is this exploited in the wild?
The record's KEV flag is false and Apple's notes do not say it is. Treat it as a routine but prompt update.
Sources
- About the security content of macOS Golden Gate 27
- About the security content of macOS Tahoe 26.7
- About the security content of macOS Sequoia 15.8
Last reviewed: 18 October 2026.
