NCSC-2026-0267 [1.00] [M/H] Vulnerabilities fixed in Apple MacOS
Apple has fixed multiple vulnerabilities in MacOS, specifically in versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. The vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions that may allow applications unauthorized access to sensitive user data. Issues related to improper memory handling, such as use-after-free, buffer overflows, out-of-bounds reads and writes, integer overflows, race conditions, and type confusion have been resolved. These can lead to unexpected system or application terminations, privilege escalation, unauthorized access to kernel memory, and in some cases remote code execution. Additionally, there are fixes for bypasses of Gatekeeper security via manipulated ZIP archives, improved validation of file and path processing, and strengthened authorization and permission controls. Improvements have also been made in network security, such as preventing interception of network connections and limiting application permissions. The updates focus on strengthening memory management, input validation, state management, and sandbox isolation to prevent unauthorized access and system instability. The vulnerabilities have been resolved in the mentioned macOS versions, and some fixes have also been implemented in related Apple operating systems such as iOS, iPadOS, tvOS, visionOS, and watchOS.
CSIRTS triage
- What
- Multiple vulnerabilities in macOS can lead to unauthorized access to sensitive user data, privilege escalation, and in some cases remote code execution.
- Who is affected
- Users of the specified versions of macOS are affected.
- Urgency
- Remediation is high urgency due to the severity of the vulnerabilities and potential for exploitation.
- Action
- Update to the latest version of macOS to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch macOS
Get an email when a new macOS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0267
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-433250.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-37830.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-37840.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-44241.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-206720.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Elevated exploitation riskCVE-2026-2391849.7% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 99% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-288490.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-288960.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-289000.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-289110.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownNCSC-2026-0371 [1.00] [M/H] Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en Sambancsc-nl
- unknownNCSC-2026-0370 [1.00] [M/H] Kwetsbaarheden verholpen in Apple iOS en iPadOSncsc-nl
- high[NEU] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstell…cert-bund
- high[UPDATE] [hoch] Apple Safari, macOS, iOS und iPadOS: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apple macOS (Tahoe, Sonoma und Sequoia): Mehrere Schwachstellencert-bund
- medium[UPDATE] [mittel] Apple iOS und iPadOS: Mehrere Schwachstellencert-bund
- unknownApple Products Multiple Vulnerabilitieshkcert
- unknownexploitedMultiples vulnérabilités dans les produits Apple (15 septembre 2026)cert-fr-avis
- medium[UPDATE] [mittel] cURL: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apache HTTP Server: Mehrere Schwachstellencert-bund
- high[UPDATE] [hoch] Apple iOS und iPadOS: Mehrere Schwachstellencert-bund
- unknownMultiples vulnérabilités dans les produits VMware (07 septembre 2026)cert-fr-avis
Recent advisories for Apple MacOS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0371 [1.00] [M/H] Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en Sambancsc-nl · 2026-09-15
- high[NEU] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstell…cert-bund · 2026-09-15
- high[UPDATE] [hoch] Apple Safari, macOS, iOS und iPadOS: Mehrere Schwachstellencert-bund · 2026-09-15
- high[UPDATE] [hoch] Apple macOS (Tahoe, Sonoma und Sequoia): Mehrere Schwachstellencert-bund · 2026-09-15
- unknownCVE-2026-84601: A permissions issue was addressed with improved state management. This issue is fixed in macOS…nvd · 2026-09-14
- unknownCVE-2026-28836: A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14…nvd · 2026-09-14
More from NCSC-NL Advisories
- unknownNCSC-2026-0371 [1.00] [M/H] Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en Samba2026-09-15
- unknownNCSC-2026-0370 [1.00] [M/H] Kwetsbaarheden verholpen in Apple iOS en iPadOS2026-09-15
- unknownNCSC-2026-0369 [1.00] [M/H] Kwetsbaarheid verholpen in Palo Alto Networks PAN-OS2026-09-15
- unknownNCSC-2026-0368 [1.00] [H/H] Kwetsbaarheid verholpen in Cisco Secure Email Gateway2026-09-14
- unknownNCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Azure2026-09-14