macOS Sonoma 14.8.9
macOS 14.8.9 known issues for MDM admins. Is it safe to deploy?
Deploy nowDeploy verdict: Deploy now
Released Aug 6, 2026. This is the current Sonoma build. It fixes CVE-2026-65400, a Screen Sharing authentication bypass (CVSS 9.8). The flaw is actively exploited and in CISA's KEV catalog, with public proof-of-concept code. Patch any Mac still on Sonoma. Caveat: a Jamf Nation thread (Aug 11) reports some 14.8.8 Macs failing the 14.8.9 update and then rejecting every login. Posters blamed a corrupted /var/db/auth.db where Jamf Connect or BeyondTrust modify the login window; renaming auth.db, or running authchanger -reset via policy, restored logins. Separately, Apple hasn't shipped a Sonoma update since Aug 6. The exploited CoreGraphics fix (CVE-2026-86950) shipped Sep 28 for Tahoe 26.7.1 and Sequoia 15.8.1 but in no Sonoma release, so plan to move Sonoma Macs to Sequoia or later.
Sources
- Apple: security content of macOS Sonoma 14.8.9
- NHS England Digital cyber alert CC-4835: CVE-2026-65400 exploited
- Jamf Nation: Sonoma devices can't log in after attempting 14.8.9 update
- Jamf Connect release notes: Known Issues (PI-1512)
- Apple security releases (no Sonoma release since Aug 6, 2026)
Checked: Apple security notes and security releases index, NHS England Digital alert, Jamf Nation, Jamf Connect known issues, web search for r/macsysadmin and r/Intune.
Last reviewed 2026-10-28.
- CVE-2026-65400 · in CISA KEV
When an update fixes a vulnerability that's already being exploited, the case for patching quickly usually outweighs waiting for more reports.
Release facts
| Version | 14.8.9 |
|---|---|
| Build | 23J631 |
| Release date | Aug 6, 2026 |
| Days since release | 83 |
| Security fixes (CVEs) | 1 |
| Actively exploited CVEs fixed | 1 |
Timing and deferral
- SOFA expiration date: Jan 26, 2027 (in 90 days). This is the
ExpirationDateSOFA reports for this build, taken from Apple's update metadata. Treat it as the date Apple may stop offering this build. It isn't an Apple-announced signing deadline. - Deferral windows (calculated from the release date):
- 30-day deferral ends Sep 5, 2026 (passed)
- 60-day deferral ends Oct 5, 2026 (passed)
- 90-day deferral ends Nov 4, 2026 (7 days left)
- Shipped 10 days after the previous macOS 14 release.
Jamf Pro + Intune notes
Jamf Pro
- Jamf Nation: after a failed 14.8.9 update, Macs rejected all logins. Posters attributed it to auth.db corruption with Jamf Connect or BeyondTrust login mechanisms. Workarounds: rename /var/db/auth.db from Recovery, or a policy running /usr/local/bin/authchanger -reset (on Startup, Login and recurring check-in). (source)
- Jamf Connect known issue PI-1512: on macOS 14.8.8 with the Jamf Connect login window (Connect 2.45.1+), Macs can show a black screen or boot loop. Jamf recommends upgrading to 14.8.9 and documents how to restore the authorization database. (source)
- Jamf: Restoring the Authorization Database (procedure from Recovery). (source)
Microsoft Intune
No product-specific reports collected yet. Know of one? Email us with a link.