macOS 27, Tahoe 26.7, Sequoia 15.8: Fixes That Matter on Developer Macs

On 14 September 2026, Apple released macOS Golden Gate 27 alongside macOS Tahoe 26.7, macOS Sequoia 15.8 and Xcode 27. The security notes list 210 CVEs for Golden Gate 27, 153 for Tahoe 26.7 and 154 for Sequoia 15.8. Kernel fixes lead the list in all three, with 29 entries in Golden Gate 27 alone.

None of these 14 September notes says a bug was exploited. That makes them easy to defer. But a developer Mac downloads archives, mounts disk images, runs package install scripts and grants terminal apps broad privacy permissions, which puts it in the path of several of these fixes. A later point release, 27.0.1 on 28 September, is a separate story and isn't covered here.

What's affected

Macs below macOS Golden Gate 27, Tahoe 26.7 or Sequoia 15.8, and Xcode below 27. The Apple security releases index shows no macOS Sonoma update on 14 September or in the 28 September round, and the last Sonoma entry is 14.8.9 from 6 August. Sonoma machines have not received these fixes.

Fixed on all three supported macOS versions:

• copyfile, CVE-2026-65399: "An archive may be able to bypass Gatekeeper." Apple describes it as a file quarantine bypass.
• file_cmds, CVE-2026-84534: "Extracting a maliciously crafted archive may allow an attacker to write arbitrary files."
• quarantine, CVE-2026-84578 and CVE-2026-84580: "An app may be able to break out of its sandbox."
• Disk Images, CVE-2026-65362: "An app may be able to gain root privileges."
• Security, CVE-2026-86881: an attacker with a compromised intermediate certificate authority "may be able to issue certificates with arbitrary extended key usages." CVE-2026-86889 is a separate certificate validation fix that could allow traffic interception.
• Software Update, CVE-2026-84609: "An app may be able to modify protected system files."

Fixed only in Golden Gate 27 (not listed for Tahoe 26.7 or Sequoia 15.8):

• Terminal, CVE-2026-28937: "An app may be able to access sensitive user data."
• TCC, CVE-2026-84589: "An app may be able to modify Privacy preferences."
• Xcode IDE, CVE-2026-65393: "An app may be able to access user-sensitive data." This one is also fixed in Xcode 27, which runs on Tahoe 26.6 and later.

How to check if you're exposed

On a single Mac:

sw_vers -productVersion
xcodebuild -version 2>/dev/null
pkgutil --pkg-info=com.apple.pkg.CLTools_Executables 2>/dev/null | grep version

For a fleet, pull the OS version field from your device management tool and group by major version. Anything below 15.8 on Sequoia, 26.7 on Tahoe, or still on Sonoma, is missing the archive and Gatekeeper fixes.

To see which terminal and IDE apps hold sensitive privacy grants on your own machine, open System Settings, then Privacy and Security, and review Full Disk Access, Developer Tools and Files and Folders. Terminal emulators, IDEs and agent tools often sit in all three.

Check that Gatekeeper is on:

spctl --status

What to do now

1. Update every developer Mac to Tahoe 26.7 or Sequoia 15.8 at minimum. These cover the Gatekeeper, archive extraction, disk image and certificate validation fixes.
2. Plan the move to Golden Gate 27 for machines that run untrusted code, because the Terminal, TCC and Xcode IDE fixes are only listed there.
3. Update Xcode to 27 on build machines and laptops that run Tahoe 26.6 or later.
4. Move Sonoma Macs to a supported release. If they can't move, treat them like unpatched endpoints: no untrusted archives, no new privacy grants.
5. Trim privacy grants. Remove Full Disk Access from tools that don't need it. A TCC or Terminal bug is worth more to an attacker when Terminal already has every permission.
6. Rebuild macOS CI images. Hosted and self-managed macOS runners keep the OS they were imaged with.

Why it matters

Developers handle untrusted archives all day: release tarballs, sample projects, zipped bug reports, dependency caches. Two of this month's fixes are about exactly that, a Gatekeeper bypass through an archive and arbitrary file writes during extraction. Those protections are what stand between "downloaded a file" and "ran attacker code."

The split between majors is the other lesson. Apple fixed most issues on all three supported versions, but not all. If your policy is "stay one major behind," you also accept that some fixes, here in Terminal, TCC and Xcode, won't reach you on that schedule.

Try it yourself

On your own Mac, run sw_vers -productVersion and spctl --status. Then open Privacy and Security and count the apps with Full Disk Access. For each one, write down why it needs it. Remove the ones you can't justify.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apple security releases index
• About the security content of macOS Golden Gate 27
• About the security content of macOS Tahoe 26.7
• About the security content of macOS Sequoia 15.8
• About the security content of Xcode 27