macOS 26.7.2 and 15.8.2 are stuck at release candidate

Three release candidates in three weeks

On 7 October 2026, Apple shipped the first release candidates for macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2 to developers. There were no regular betas beforehand. By 19 October, the third RC round for both versions had arrived.

In both cases the release notes mention only important security fixes and recommend rolling the update out to all users. Which CVEs are being closed has not been published at the time of writing. Whether the final builds have since shipped cannot be answered reliably from the available sources. Check the current state via the Apple Security Releases overview.

The current branch keeps moving in parallel. macOS 27 Golden Gate arrived on 14 September, 27.0.1 on 28 September, and the release candidate for 27.2 on 19 October. Among other things it adds Siri AI in five further languages, French included. macOS 27 runs on Apple Silicon only.

Apple is adding entries to older advisories

On 19 October, Apple inserted a number of entries into security documents that had already been published, marked with the date of the addition. The documents for macOS Tahoe 26.7 and for iOS 26.7 and iPadOS 26.7 are among those affected.

The additions include a privilege escalation through an AMD component, a buffer overflow in APFS that causes a system abort, a race condition that lets a sandboxed app run code with kernel privileges, and a baseband issue allowing denial of service from a privileged network position.

In practice, an advisory you read and filed in September now describes a different scope. If you document patch compliance from archived copies, your records have been out of date since 19 October.

The trigger from September

macOS Sequoia 15.8.1 and Tahoe 26.7.1 were released on 28 September 2026. The content was essentially a single fix in CoreGraphics. A crafted file could execute arbitrary code, and according to Apple it may have been exploited in a sophisticated attack.

The flaw carries the identifier CVE-2026-86950 and was rated CVSS 8.8. The US agency CISA added it to the KEV catalogue on 29 September, with a deadline of 2 October for federal agencies. An attack path through an image file lands squarely in the daily work of a creative agency, meaning client data, transfer folders and print files from outside sources.

What this means for your fleet

Machines that remain on Tahoe 26 or Sequoia 15 for good reasons, such as Intel hardware, plug-in dependencies or certified prepress chains, have been sitting on 26.7.1 or 15.8.1 since the start of October. The next security build has been announced and has not arrived. This affects the workstations that carry editorial work, shop maintenance and deployments. The servers are unaffected.

A rushed move to macOS 27 solves nothing. Intel Macs cannot make the jump, and there is currently no solid information on how 27.2 behaves with Adobe, Affinity or RIP chains. Wait for the vendors to clear it. Keep the 27.2 release candidate out of production.

Concretely, for the next few days:

• Inventory the fleet and count how many machines sit on 26.7.1, 15.8.1 and 27.0.1.

• Verify that CVE-2026-86950 is closed everywhere, so at least 26.7.1, 15.8.1 or iOS 26.7.1.

• Open the live security documents for macOS Tahoe 26.7 and iOS 26.7 on support.apple.com and compare them against the entries added on 19 October.

• Set the deferral windows in your MDM so that 26.7.2 and 15.8.2 can be installed promptly.

• Leave iOS 27.1 out of your update targets, as it is reserved for the foldable iPhone Duo.