# IT Daily Roundup – September 20, 2026

> Sep 20, 2026 · #apple #security #chrome

Apple releases macOS 27 Golden Gate and iOS 27, N-able patches a fourth CVSS 10.0 critical flaw in N-central in five weeks, and Chrome fixes an actively exploited V8 zero-day.

## 1. Apple Releases macOS 27 Golden Gate and iOS 27 – Time to Plan Your Business Rollout

During the week of September 15–19, Apple made the final versions of macOS 27 Golden Gate, iOS 27, iPadOS 27, watchOS 27, visionOS 27, and tvOS 27 available to all users. The release comes roughly two weeks after the "Surprise and Shine" hardware event (September 9), at which Apple unveiled the iPhone 18 Pro, iPhone Duo, and other new devices. The new OS versions include security patches, expanded Apple Intelligence capabilities, and new protection tools — including newly available security controls for devices managed in school and enterprise environments. Apple also announced expanded child safety features, which may introduce new configurable policies for MDM administrators.

> **Why this matters:** For corporate environments, one rule applies: test first, then deploy. Major OS releases — especially macOS — can break compatibility with key business applications, VPN clients, or MDM profiles. We recommend testing internal application compatibility before any mass rollout, checking security software vendor advisories, and waiting at least one to two weeks for potential critical follow-up patches. Company-owned devices managed via Jamf, Intune, or Apple Business Manager should receive the update only after successful testing on a pilot group of machines.

## 2. N-able N-central: Fourth Critical Patch in Five Weeks – CVSS 10.0 Unauthenticated RCE

N-able released on September 6 yet another (the fourth in five weeks) emergency hotfix for its N-central platform. Vulnerability CVE-2026-86218 carries a maximum CVSS score of 10.0 and allows an unauthenticated attacker to execute arbitrary code directly on the N-central server with no credentials required — a static code injection flaw (CWE-96) on the internet-exposed management console. N-central is a remote monitoring and management (RMM) platform used by IT companies and MSP providers to manage entire fleets of client devices. Cloud-hosted N-central instances are patched automatically; organizations running on-premises installations must immediately upgrade to version 2026.3.1.14.

> **Why this matters:** From an attacker's perspective, N-central is the "master key" to every MSP — whoever controls the N-central server can reach all managed client devices simultaneously through the Take Control feature. Four critical patches in five weeks signals an intensive security review of the platform and growing attacker interest in MSP tooling as an entry point into client networks. If you use IT outsourcing or managed services, it is both legitimate and advisable to ask your provider which version of N-central they are running and whether the patch has been applied — and also whether the N-central console is access-restricted via IP allowlisting or VPN rather than publicly exposed to the internet.

## 3. Chrome Patches Its Sixth Actively Exploited Zero-Day of 2026 – CVE-2026-85046

Google released Chrome 152.0.7977.82/83 (Windows/macOS) and 152.0.7977.82 (Linux), fixing the actively exploited vulnerability CVE-2026-85046 (CVSS 8.8) in the V8 JavaScript engine. The flaw is a type confusion issue — incorrect type assignment when processing JavaScript arrays — which allows an attacker to execute arbitrary code inside the browser's sandbox architecture via a specially crafted web page. This is the sixth actively exploited Chrome zero-day in 2026. CISA mandated federal agencies to patch by September 18 (yesterday). The same vulnerability affects other Chromium-based browsers: Microsoft Edge, Brave, Opera, and Vivaldi.

> **Why this matters:** Chrome and Edge are the standard browsers on most corporate workstations. Active exploitation in the wild means that a real attack exists in which simply visiting a malicious page is enough to trigger it — no download confirmation or click required. We recommend verifying the browser version on all company devices (Chrome: Settings → Help → About Google Chrome; Edge: Settings → Help and feedback → About Microsoft Edge) and ensuring automatic updates are enabled. For larger fleets, deploying browser updates via MDM (Intune, Jamf) or Group Policy is the most reliable approach — and verify that Edge and other Chromium browsers are equally up to date.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-20-it-daily-roundup.html