On September 28, Apple released three macOS updates at once: macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. They aren’t three versions of the same fix. Which one you need depends on the macOS you run, and if you chose not to move to Golden Gate, the update meant for you is the urgent one.
Which update do you need?
| You run | Install | Why |
|---|---|---|
| macOS 27 Golden Gate, including new Macs that shipped with it | 27.0.1 | Bug fixes. Apple lists no security fixes in it. |
| macOS 26 Tahoe, including every Intel Mac on its last supported version | 26.7.1 | Fixes a CoreGraphics vulnerability Apple says may have been exploited |
| macOS 15 Sequoia | 15.8.1 | Same CoreGraphics fix |
| macOS 14 Sonoma or earlier | No fix available | See below |
To check your version, choose Apple menu > About This Mac.
What the vulnerability is
The fix in 26.7.1 and 15.8.1 addresses CVE-2026-86950, an out-of-bounds write in CoreGraphics, the system framework that draws and processes images, PDFs and other graphics. Opening or previewing a maliciously crafted file could lead to arbitrary code execution. Meta Product Security reported it.
Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. So far there’s no public evidence of attacks against Macs, and it was a targeted attack, not a mass campaign. But CoreGraphics handles files that arrive through Mail, Messages, browsers and downloads, so once a flaw like this is public, delaying the patch isn’t worth it.
The Golden Gate 27 branch doesn’t appear to be affected, which is why 27.0.1 has no security entries.
Install the fix without upgrading to Golden Gate
If you’re staying on Tahoe or Sequoia, be careful in Software Update. The big Upgrade Now button installs Golden Gate, not your security update.
- Open System Settings > General > Software Update.
- Look below the Golden Gate upgrade for Other updates are available or More info, and click it.
- Select macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, and click Install Now.
The update needs a restart. Save your work first, and on a MacBook, plug in.
Still deciding whether to move to Golden Gate at all? Our guide to upgrading now or waiting lays out the trade-offs, and the pre-upgrade checklist covers what to do before you click.
After installing: confirm it worked
Don’t assume the restart did its job. Choose Apple menu > About This Mac and look at the version, or run this in Terminal:
sw_vers -productVersionYou should see 26.7.1 on Tahoe, 15.8.1 on Sequoia or 27.0.1 on Golden Gate. If the old number is still there, go back to Software Update and look again under Other updates.
If your Mac is new
New Macs sold now ship with Golden Gate or offer it during setup. Install 27.0.1 as soon as you finish setting up. If a new Mac came with Tahoe and you intend to keep it there, install 26.7.1 before you start using it for email and browsing.
Check your automatic update settings
In Software Update, click the info button next to Automatic Updates. For the best protection, keep Install Security Responses and system files on. Install macOS updates applies updates within the version you run. Major upgrades like Golden Gate still ask first, but read each prompt before you click.
Managed work Macs follow your IT department’s schedule. If your Mac is managed and still shows an older version, ask IT when the update is going out.
Reduce your exposure while you update
Because this flaw is triggered by processing a file, the practical habits are the same as always, and they matter more until you’ve patched:
- Don’t open or preview unexpected PDFs, images and attachments, especially from people you don’t know.
- Keep Safari and your other apps up to date, since browsers and mail clients also open files.
- If you could plausibly be a target, such as a journalist, activist or executive, consider Lockdown Mode in System Settings > Privacy & Security. It restricts some features to shrink the attack surface.
If you’re on Sonoma or older
Apple has released this fix only for Tahoe and Sequoia. Macs on macOS 14 Sonoma or earlier stay exposed to this vulnerability.
- If your Mac can run a newer macOS, upgrade to at least Sequoia and install 15.8.1.
- If it can’t, be careful with files and attachments from people you don’t know, keep Safari and your other apps updated and start planning to replace the Mac.
Planning the replacement
A Mac that no longer gets security fixes deserves less trust with banking, work email and anything sensitive. Before you buy its successor, find out what is really coming. NVIDIA RTX Spark in a MacBook or iMac explains what is and isn’t coming to the Mac lineup, which is useful context before you spend money.
The short version
On Golden Gate, install 27.0.1. On Tahoe, install 26.7.1; on Sequoia, 15.8.1. Those two fix a CoreGraphics flaw Apple says may have been exploited in targeted attacks. If you’re avoiding Golden Gate, install the security update from the „Other updates” section of Software Update, not the Upgrade Now button.