Apple security updates for macOS, October 2026: one denial-of-service flaw fixed in Sequoia 15.8.2

The release at a glance

Apple's October 2026 macOS security update contains one CVE in scope: CVE-2026-112601. The release covers only the macOS product, and the single item is unscored. Apple describes the flaw as an integer overflow addressed with improved input validation. An app may be able to cause a denial-of-service on an affected Mac. The CVE record was published on 26 October 2026. The fix is available and the fixed version is macOS Sequoia 15.8.2; affected systems are those running macOS before 15.8.2.

The CVE has no CISA KEV entry, no known exploitation and no public disclosure recorded. It has no CVSS score, no CWE identifiers and no vendor severity rating. The EPSS model gives a 0.2% probability of exploitation, at the 9th percentile. With a single unscored flaw, this update can be treated as a standard macOS change rather than an emergency.

What matters most

macOS. CVE-2026-112601 affects macOS before 15.8.2 and is fixed in macOS Sequoia 15.8.2. It is the only vulnerability in this release, so it is the first and only item to review for a Mac estate. The issue is an integer overflow that an app may be able to trigger to cause a denial-of-service. There is no CISA KEV entry for this CVE, no known exploitation and no public disclosure associated with it. There is no assigned CVSS severity score; no CWE identifiers or vendor severity rating are listed either. EPSS puts the likelihood of exploitation at 0.2%, in the 9th percentile. That makes prioritisation a coverage task: confirm every managed Mac can receive the update and then deploy macOS 15.8.2 across the estate. Because no other CVEs are in scope, there is no competing patch priority inside this release.

Patch in this order

1. Update macOS to macOS Sequoia 15.8.2. This is the fixed version for CVE-2026-112601, the only CVE in the October macOS release. There is no CISA KEV due date because the CVE is not in KEV, and no known exploitation is associated with it. Apply the update through your normal macOS patching process and verify that all managed Macs move to 15.8.2.

1. After deployment, review your inventory for any Macs still reporting a version before 15.8.2. Apple's stated trigger is an app causing a denial-of-service; no other vector is described, so completing estate coverage is the main control.

1. Treat this release as a routine patch-cycle item. No CVE in this release appears in CISA KEV, and none is marked as exploited; with no separate advisories or further CVEs in scope, there is no competing priority inside this release. Once the update is deployed and inventory is verified, close the release.

Beyond the patch

A single-CVE release can slip between larger patch cycles, but it still shifts your vendor exposure window. Supply Chain Defense & Third-Party Risk helps you track which vendors' software you run and how quickly they fix it, so a macOS update like this one is scheduled, verified and closed rather than missed. If you need to map that work to NIS2 or DORA, see the NIS2 / DORA frameworks page or book a meeting to discuss it. Use this release as the trigger to confirm your recurring Apple patch cadence is producing the expected macOS versions.