Apple security updates for macOS, October 2026: three flaws fixed in Sequoia 15.8 and Tahoe 26.7

The release at a glance

Apple's October 2026 macOS security update addresses three CVEs, all in macOS. The fixed versions are macOS Sequoia 15.8 and macOS Tahoe 26.7; Apple states these versions fix all three issues. The release contains one high-severity vulnerability and two medium-severity vulnerabilities. All three are local issues: Apple's advisory describes each as reachable by an app running on the Mac, rather than by a remote, unauthenticated attacker. Apple does not list any of the three CVEs in CISA KEV, and none is reported as exploited or publicly disclosed. The three CVE records were published on 20 October 2026.

What matters most

All Macs running macOS before 15.8 or before 26.7 are in scope for these fixes. The first issue to review is CVE-2026-28853, a high-severity privilege-escalation flaw. Apple says an app may be able to elevate privileges; the CVSS 3.1 vector is local, requires low privileges and no user interaction, and scores 7.8 with impact on confidentiality, integrity and availability. The flaw arises from checks that Apple tightened; it is assigned CWE-269. This is the only high-severity issue in the release, and because it can move an app from low privileges to higher ones, it should be highest on the patch list.

Next is CVE-2026-86981, an out-of-bounds write fixed with improved bounds checking. An app may be able to cause unexpected system termination; it is medium severity with a CVSS score of 5.5. The vulnerability is assigned CWE-787 and carries an EPSS of 0.1, indicating a low estimated likelihood of exploitation. Last is CVE-2026-86907, an authorization issue fixed with improved entitlement checks. An app with admin privileges may be able to modify the System Keychain; this is medium severity with a CVSS score of 4.4. It is assigned CWE-862. Apple's advisory does not identify the specific macOS components affected beyond these descriptions.

Patch in this order

1. Update managed Macs to macOS Sequoia 15.8 or macOS Tahoe 26.7. These versions contain the fixes for all three CVEs in this release.
2. Prioritise CVE-2026-28853 first. It is the only high-severity issue in the release and allows a low-privileged app to elevate privileges with full system impact. Test the update on a small set of managed Macs, then deploy broadly.
3. Apply the same update for the two medium-severity issues. CVE-2026-86981 can crash the system through an out-of-bounds write, and CVE-2026-86907 can allow an app with admin privileges to modify the System Keychain. The System Keychain is a sensitive store, so treat the keychain issue as higher priority than its 4.4 base score alone suggests.

No additional workaround has been published; applying the macOS update is the documented remediation. There is no CISA KEV due date for this release.

Beyond the patch

A three-CVE macOS release is straightforward to operationalise if you can see which devices have not yet installed the update and watch for local privilege-escalation or keychain misuse. Managed Detection & Response (MDR) covers the detection side: code execution, privilege escalation or credential abuse leaves a trail that EDR and SIEM detect. Supply Chain Defense & Third-Party Risk keeps the exposure window visible, because how quickly the platforms you depend on publish fixes sets how long your fleet remains exposed. Applying the October update promptly closes that window for macOS.