Apple security updates for macOS, October 2026: one denial-of-service fix for macOS Sequoia

The release at a glance

Apple's October 2026 macOS security release is a single CVE: CVE-2026-112601. The CVE record was published on 26 October 2026. Apple describes the problem as an integer overflow that was addressed with improved input validation. The vendor fix is macOS Sequoia 15.8.2, and the affected product is macOS before 15.8.2. An app may be able to cause a denial-of-service.

This release has no exploited entries and no entries in CISA's Known Exploited Vulnerabilities catalogue. The single CVE is currently unscored; the available record does not provide a CVSS severity rating. There is also no indication of public disclosure or active exploitation. For readers, that makes this a routine macOS update rather than an emergency response.

What matters most

The vulnerability to review is CVE-2026-112601, which affects macOS. Apple's stated impact is narrow: an app may be able to cause a denial-of-service. The underlying issue is an integer overflow, and Apple addressed it with improved input validation. Systems running macOS before 15.8.2 are affected; macOS Sequoia 15.8.2 is the fixed version.

There is no CVSS severity, CWE, or vendor severity rating published for this CVE, so it cannot be ranked against other CVEs by score. It is not in CISA KEV, and the exploitation record does not show active exploitation or public disclosure. EPSS places the estimated exploitation probability at 0.2%, in the 9th percentile, which is low. The item matters because it is the only vulnerability in this macOS release and because an unpatched Mac can still be disrupted locally. Readers already running macOS 15.8.2 or later are outside the affected range.

Patch in this order

1. Update all managed Macs running macOS versions before 15.8.2 to macOS Sequoia 15.8.2. This is the only fix in the October release, and Apple has published it.
2. Treat this as routine maintenance. CVE-2026-112601 is not exploited and not in CISA KEV, so there is no CISA due date. A standard change window is appropriate.
3. Confirm the update reaches the full macOS estate. The main risk is an unpatched device; there are no other CVEs in this release to sequence.
4. If deployment tooling or user deferral has previously delayed macOS updates, give those devices particular attention before the next release.

Beyond the patch

A release with one CVE is less about urgency than about accuracy. The organisation's exposure is set by how quickly it knows which macOS versions are in the estate and how reliably it deploys Apple's fixes. Supply Chain Defense & Third-Party Risk tracks the software suppliers and versions you run and how fast they fix them, turning updates like this into a scheduled task. If you want to review how that tracking works in your environment, book a meeting.