Apple closed more than 260 Mac flaws in a single afternoon, and the most dangerous ones let an ordinary app climb to the highest level of the operating system.
A root path that starts with any app
The macOS Golden Gate 27.2 advisory lists 262 CVE entries. A logic error in the kernel, tracked as CVE-2026-112438, let an unprivileged attacker run code as root. Separate kernel race and access bugs, CVE-2026-112543 and CVE-2026-112624, opened sandbox escapes and a route around Privacy preferences. Tahoe 26.7.2 separately closed a Wang Yu flaw allowing kernel-level code execution, CVE-2026-86916, which never reached the Golden Gate advisory.
Gatekeeper takes six separate hits
Mac users are trained to trust the warning screens that judge software before it runs. Attackers found six ways past them, in ArchiveService, DesktopServices, LaunchServices, BOM, libarchive and System Settings. One is a file quarantine bypass, CVE-2026-112494. A researcher credited as YingMuo worked with Paul Montgomery on a second Gatekeeper escape, CVE-2026-86937.
Screen Sharing and Remote Management
The Screen Sharing server carried four fixes, including a path handling error that let a malicious peer create arbitrary symlinks as root, CVE-2026-112511, and a remotely reachable heap corruption, CVE-2026-84590. Remote Management had an authorization gap allowing system-level code execution.
Who gets what
The fixes arrived October 26 across Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, alongside iOS 27.2, iOS 26.7.2, iOS 18.7.11 for older iPhones, iPadOS, watchOS, tvOS, visionOS and Safari. Those counts overlap heavily, so the true total sits well under the sum of every advisory. Apple lists no exploited-in-the-wild flags in the advisories reviewed, and no CVE from this wave sits in CISA’s must-patch catalog.
Sequoia and Tahoe users should update without waiting. The root and Gatekeeper bugs need nothing more than running a file.
