Apple security updates for macOS, tvOS and visionOS, October 2026: six high-severity macOS flaws lead 123 CVEs

The release at a glance

In its October 2026 release, Apple published security updates for macOS, tvOS and visionOS. The part of the release we cover here is the 123 CVEs affecting macOS: six are rated high severity, seven medium and 110 are unscored. None of the CVEs is listed in CISA's Known Exploited Vulnerabilities catalogue, and the release does not identify any as exploited. The main macOS fix points are macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2; several of the most serious flaws are fixed only in macOS Golden Gate 27.2.

What matters most

All six high-severity CVEs affect macOS. The first two to review are network-facing code-execution flaws. CVE-2026-112438 is a logic issue that could let an unprivileged attacker execute arbitrary code as root; it is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. CVE-2026-112427 is an authentication issue that could allow a remote attacker to achieve arbitrary code execution without user interaction; Apple fixed it in macOS Golden Gate 27.2 only.

The other high-severity flaws are local or adjacent rather than remote. CVE-2026-65327 lets a local attacker elevate privileges and is fixed in all three macOS versions. CVE-2026-112484 lets a malicious application execute arbitrary code with system privileges, also fixed in all three. CVE-2026-113947 can lead to unexpected app termination or code execution when a user unpacks a maliciously crafted archive; the fix is in macOS Golden Gate 27.2 only. CVE-2026-112457 is a double-free issue exploitable from the local network that may cause unexpected system termination or corrupt process memory; it is fixed in all three versions.

Patch in this order

1. Apply macOS Golden Gate 27.2 first. This closes CVE-2026-112427, CVE-2026-112438 and CVE-2026-113947, the three most serious remote or archive-based code-execution flaws.
2. On macOS Sequoia, move to 15.8.2, and on macOS Tahoe, move to 26.7.2. These updates address CVE-2026-112438, CVE-2026-65327, CVE-2026-112484 and CVE-2026-112457.
3. Put systems that mount disk images or unpack archives earlier in the sequence where possible; the medium-severity disk-image flaws require user interaction, but they can still terminate the system or corrupt kernel memory.
4. Then complete the macOS update for the seven medium-severity and 110 unscored CVEs. Apple's advisory pages carry the full list; no CISA KEV due date applies to this release.

Beyond the patch

This release is a risk-based patch decision rather than an emergency response: there is no exploited or KEV entry to force a single due date. The priority is to know which macOS versions are deployed and where the network-reachable flaws sit. Managed Detection & Response (MDR) can provide detection for the privilege escalation or code execution activity that these flaws could enable, while Supply Chain Defense & Third-Party Risk helps track Apple's patch cadence across your estate so next month's update lands in already-scoped maintenance windows.