Apple security updates for macOS, tvOS and visionOS, October 2026: six high-severity fixes lead 123 CVEs

The release at a glance

Apple has released its October 2026 security updates for macOS, tvOS and visionOS. The updates address 123 CVEs in scope for our readers, all of them affecting macOS. Six are scored high severity, seven are medium, and 110 are currently unscored. No CVE in this release is listed in CISA KEV or marked exploited.

The main fixes are for macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. The most serious issues include arbitrary code execution as root, a remote authentication issue, a malicious archive issue, and several local privilege escalations.

What matters most

All the items below affect macOS. Apple has fixed them in the October 2026 updates.

• CVE-2026-112438: a logic issue allowing an unprivileged attacker to execute arbitrary code as root. Fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. This is the highest-priority item because it enables root code execution.
• CVE-2026-113947: a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution. Fixed in macOS Golden Gate 27.2.
• CVE-2026-65327: a local attacker may elevate their privileges. Fixed in all three macOS versions.
• CVE-2026-112427: a remote authentication issue may allow arbitrary code execution with no user interaction, at high attack complexity. Fixed in macOS Golden Gate 27.2.
• CVE-2026-112484: a malicious application may execute arbitrary code with system privileges. Fixed in all three macOS versions.
• CVE-2026-112457: a double free that an attacker on the local network could use to cause unexpected system termination or corrupt process memory. Fixed in all three macOS versions.
• CVE-2026-113939 and CVE-2026-84496: out-of-bounds write issues when mounting a maliciously crafted disk image; they can cause unexpected system termination or corrupt kernel memory. CVE-2026-113939 is fixed in macOS Golden Gate 27.2; CVE-2026-84496 is fixed in macOS Golden Gate 27.2 and macOS Tahoe 26.7.2.

Patch in this order

Since none of these CVEs are exploited or in CISA KEV, prioritise by severity and exposure. Use this order:

1. Patch macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2 to address CVE-2026-112438, the root code-execution issue.
2. Patch macOS Golden Gate 27.2 to address CVE-2026-112427, the remote authentication issue with no user interaction, and CVE-2026-113947, the malicious archive issue.
3. Apply the same updates to address CVE-2026-65327 and CVE-2026-112484, which allow privilege escalation or system-level code execution.
4. Apply the updates where CVE-2026-112457 could be reached from a local network segment.
5. Complete the remaining macOS updates in this release.

Beyond the patch

With six high-severity fixes and none exploited, the practical task is to find which macOS versions are exposed before they are patched. Virtual CISO Services provides the exposure-management view for internet-facing Macs and services, matching CVE-2026-112427's remote, no-interaction vector. Managed Detection & Response provides EDR and SIEM monitoring to catch any post-exploitation trail from the root or privilege issues.