Apple macOS security updates, October 2026: privilege escalation and System Keychain issue fixed in Sequoia and Tahoe

The release at a glance

Apple published security updates for macOS on 20 October 2026. The release covers 3 CVEs, all affecting macOS. One is rated high with a CVSS 3.1 score of 7.8; the other two are rated medium, with scores of 5.5 and 4.4. All three are fixed in macOS Sequoia 15.8 and macOS Tahoe 26.7.

None of the CVEs is listed in CISA KEV, so no CISA-defined due date applies. The CVSS vectors describe local attack scenarios: each lists an attack vector of local, and they require either low or high privileges rather than unauthenticated network access. The update is a routine macOS patch cycle rather than an out-of-band response. The first decision is whether the privilege escalation described in CVE-2026-28853 justifies moving the update ahead of lower-priority maintenance.

What matters most

All three CVEs affect macOS before macOS Sequoia 15.8 or macOS Tahoe 26.7. They are grouped here by product; none is covered by a separate advisory.

Under macOS, the three issues are:

• CVE-2026-28853 — privilege escalation. Apple addressed the issue with improved checks. An app may be able to elevate privileges. This is the highest-rated item in the release: CVSS 3.1 7.8/high, local attack vector, low privileges required, no user interaction, and high impact on confidentiality, integrity and availability. CWE-269.
• CVE-2026-86981 — out-of-bounds write. Apple addressed the issue with improved bounds checking. An app may be able to cause unexpected system termination. CVSS 3.1 5.5 medium, local attack vector, low privileges, and high availability impact only. CWE-787.
• CVE-2026-86907 — authorization issue. Apple addressed the issue with improved entitlement checks. An app with admin privileges may be able to modify the System Keychain. CVSS 3.1 4.4 medium, local attack vector, high privileges required, and high integrity impact only. CWE-862.

The first item ranks first because it combines a high severity rating with low privileges and a full confidentiality, integrity and availability impact from a local app. The other two are lower rated: the out-of-bounds write leads to system termination rather than broader impact, and the Keychain issue assumes the app already has admin privileges.

Patch in this order

1. Establish which Macs are below the fixed versions: macOS Sequoia before 15.8 or macOS Tahoe before 26.7. No CISA KEV due dates apply because none of the three CVEs is listed in KEV.
2. Prioritise devices where standard, non-admin local accounts run third-party or unvetted applications. CVE-2026-28853 requires only a local app with low privileges and no user interaction, so those devices carry the most exposure to the release's only high-severity flaw.
3. Deploy macOS Sequoia 15.8 or macOS Tahoe 26.7 through your normal macOS update mechanism. All three CVEs are fixed by the same versions, so there is no separate patch ordering within the release.
4. Treat the remaining two issues as part of the same deployment window. CVE-2026-86981 can allow an app to cause unexpected system termination; CVE-2026-86907 can allow an app that already has admin privileges to modify the System Keychain. Neither brings the same combination of low privilege and full impact as the privilege escalation issue.
5. After deployment, confirm devices report the expected macOS version — 15.8 or 26.7 — so that no Mac is left below the fixed baseline.

Beyond the patch

Three local macOS vulnerabilities in a single update are manageable when patch oversight is already routine. Managed Detection & Response (MDR) provides continuous EDR and SIEM monitoring for the post-exploitation signals that missed patches can produce — unexpected privilege changes, repeated system termination, or unusual access to the System Keychain — which is the MDR use case for code execution, privilege escalation or credential abuse. For organisations that run Macs alongside software from many other suppliers, Supply Chain Defense & Third-Party Risk helps track which vendors' software you run and how quickly their fixes arrive, so this macOS patch cycle can be folded into your wider exposure tracking rather than treated as an isolated event.