Apple iOS 27, macOS Golden Gate Patch 200 Vulns

Apple released iOS 27 and macOS Golden Gate 27 on September 15, fixing roughly 200 security vulnerabilities across both platforms. Kernel-level bugs are among the patched items. No active exploitation confirmed at publication time.

What’s patched

The kernel fixes span four impact classes: memory corruption, privilege escalation, system termination, and information disclosure.

Memory corruption in kernel context is the most severe. Kernel code runs at the highest privilege level on both platforms; a successful exploit in that space can give an attacker unrestricted control over the device or machine. Privilege escalation bugs let a lower-privileged process move into kernel mode. System termination flaws let a malicious app crash the OS on demand. Information disclosure bugs expose kernel memory contents to unprivileged callers, a common component in multi-stage exploit chains designed to bypass address space layout randomization (ASLR).

SecurityWeek reported the total at approximately 200 vulnerabilities across both platforms. Full CVE assignments and per-product impact details are in Apple’s security content notes.

Platform scope

iOS 27 covers iPhone and iPad. macOS Golden Gate 27 covers Mac. Prior OS versions may receive back-ported fixes for the most critical items. The complete version matrix is in Apple’s security updates listing.

Exploitation status

No CISA KEV additions tied to these releases at publication time. Confirmed. Whether any of the approximately 200 flaws were known to attackers before Apple’s disclosure is unconfirmed. Apple does not label pre-disclosure exploitation in its advisories unless exploitation was actually observed before the patch shipped. Absence of that language is inconclusive, not a clean bill.

Update path

iOS and iPadOS: Settings > General > Software Update. macOS: System Settings > General > Software Update.

Analysis: Major OS releases generate binary diffs that researchers analyze for vulnerability reproduction quickly after advisories publish. The 200-vulnerability scope of this release means more attack surface to work from. The window for patching ahead of any exploitation is typically shorter after a large, high-profile release than after routine point updates.

Prior Apple patch cycles this summer

Apple has shipped several major security batches since July. The August 17 release patched 108 vulnerabilities in iOS, iPadOS, and macOS 26. An August 19 follow-up addressed 27 additional flaws in the Tahoe branch. Today’s release is the largest single batch of the cycle.