Apple has rolled out iOS 27, iPadOS 27, and macOS Golden Gate 27 in a coordinated platform refresh that closes more than 200 documented security holes across its mobile and desktop ecosystems[1][2][4][6][7][12][15]. The wave of patches lands as part of Apple’s annual operating system upgrade cycle, which this year spans iOS, iPadOS, macOS, tvOS, watchOS, and visionOS releases[4][10][13]. For security teams already grappling with summer backport updates in iOS 26.6.x and macOS Tahoe 26.6.x, the new versions mark the start of a fresh, high‑impact patching window[8][9].
According to technical details published by SecurityWeek, iOS 27 and iPadOS 27 ship with fixes for roughly 126 vulnerabilities, including about 20 kernel issues, while macOS Golden Gate 27 addresses around 210 flaws, nearly 100 of which overlap with the mobile release[1]. Separate analyses by 9to5Mac and Neowin put the number of security bugs fixed in iOS 27 at more than 120, with one outlet counting 122 distinct vulnerabilities across Apple’s mobile platform[7][15]. A breakdown from Mallory.ai notes that iOS 27 alone mitigates more than 100 vulnerabilities, with the security‑only iOS 26.7 update closing more than 80 additional issues, 75 of which are shared with iOS 27, giving organizations reluctant to jump to a major new OS a partial remediation path[12].
The patched flaws span critical attack surfaces, with kernel, sandbox, Gatekeeper, and privilege‑boundary bugs featuring prominently in Apple’s security content and media coverage[1][2][7][15]. On macOS Golden Gate 27, 9to5Mac reports that fixes address vulnerabilities that could let malicious apps or remote attackers execute arbitrary code with kernel or root privileges, escape the macOS sandbox, bypass Gatekeeper checks, modify protected system files, or access sensitive user data[2]. Similar classes of issues are present on iOS and iPadOS, where Apple’s advisories list flaws that could be triggered by malicious apps, crafted web content, or compromised system components to gain elevated privileges or leak information[7][15]. A CVE feed tracking Apple vulnerabilities shows entries tagged to iOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, with CVSS scoring columns indicating that many of the issues fall into high‑severity territory, though full score data is still being populated[14].
Apple’s security releases page confirms that macOS Golden Gate 27 is available for Apple‑silicon MacBook Air and MacBook Pro models, Apple‑silicon iMac and Mac mini systems, Mac Studio, and the Apple‑silicon Mac Pro, with the update dated 14 September 2026[6]. The same page enumerates iOS 27 and iPadOS 27 availability for recent iPhone and iPad hardware, aligning with the company’s broader hardware support strategy for its annual OS cycle[6][7]. For customers staying on older platforms, Apple has already pushed substantial backport updates—macOS Tahoe 26.6.2, iOS and iPadOS 26.6.1, and iOS/iPadOS 18.7.10—that delivered many of the same fixes originally developed in the macOS Golden Gate 27 beta, closing more than 120 vulnerabilities across legacy devices[8][9].
While Apple’s advisories and early media coverage focus on the breadth and technical depth of the vulnerabilities being patched, none of the public writeups surveyed so far highlight confirmed exploitation in the wild for the specific issues addressed in iOS 27 and macOS Golden Gate 27[1][2][4][7][12][15]. Nonetheless, the presence of multiple kernel‑level bugs, privilege‑escalation paths, and mechanisms to bypass core macOS protections such as Gatekeeper and sandboxing underscores the risk that attackers could rapidly integrate newly disclosed weaknesses into exploit chains once diffs and proof‑of‑concept code appear[2][7][14][15]. Security researchers have already drawn attention to Apple’s growing list of kernel and system‑framework vulnerabilities over recent release cycles, warning that even without widely reported zero‑day exploitation, the window between disclosure and weaponization continues to shrink[1][4][7].
The September releases also come with operational caveats for defenders. A technical blog tracking Apple’s update cadence notes a reported iOS 27 download and version‑reporting mismatch in early rollout, as well as the need to update popular host‑based security tools such as Little Snitch and Objective‑See’s BlockBlock to newer builds before upgrading macOS systems to Golden Gate 27[4]. Organizations that rely on these tools for outbound connection control or persistence detection may need to stage upgrades carefully to avoid blind spots during the transition[4]. At the same time, the existence of security‑only paths like iOS 26.7 and macOS Tahoe 26.7—covering many of the same CVEs as the flagship releases—offers a compromise option for enterprises that cannot immediately deploy full OS upgrades across fleets[4][12][14].
For defenders, the immediate task is to inventory devices against Apple’s supported hardware lists, prioritize high‑value endpoints running vulnerable versions, and schedule updates to iOS 27, iPadOS 27, and macOS Golden Gate 27—or their security‑only counterparts—as quickly as operational constraints allow[1][2][6][12][14]. Given the concentration of kernel and privilege‑related bugs in this cycle, patching endpoints exposed to untrusted networks or running sensitive workloads should take precedence over less critical systems[1][2][7][15]. Teams should also monitor evolving CVE entries and CVSS scores for these vulnerabilities, watching for any subsequent advisories from government agencies or security vendors that flag active exploitation or add them to known‑exploited catalogs[1][4][14].
References
- Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
- macOS 27 Golden Gate, macOS Tahoe 26.7, and macOS Sequoia …
- Apple Updates Everything – f4n6
- Apple Security Releases
- Here’s every security fix included in iOS 27 and iPadOS 27
- Apple Backpatches Beta Security Fixes into macOS 26.6.2 …
- Apple Patches 122 Flaws including macOS Screen Sharing Flaw (CVE-2026-65400)
- Internet Storm Center Diary 2026-09-14 – SANS ISC
- Apple Patches 261 Flaws Across iOS, macOS, and Other …
- Apple Updates Everything – SANS Internet Storm Center
- Latest Apple Vulnerabilities – Feedly
- iOS 27 fixes 122 security vulnerabilities, including serious kernel flaws
