{"id":"CVE-2026-112427","kind":"vulnerability","aliases":["CVE-2026-112427"],"related":[],"title":"macOS: authentication state flaw lets a remote attacker run code","description":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.","summary":"An authentication state-management flaw in macOS allows a remote attacker to potentially execute arbitrary code on affected Macs. Apple fixed it in macOS Golden Gate 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-on-macos-27.2-or-later"],"how_to_check":"- Check the installed macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` in a terminal.\n- Compare the result against `27.2`; anything earlier is unpatched for this issue.","fix":"- Update macOS to `27.2` or later via System Settings > General > Software Update.","status":"open","published_at":"2026-10-26T21:17:32+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","triaged_at":"2026-10-26T21:31:45+00:00","updated_at":"2026-10-26T21:31:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` or later via System Settings > General > Software Update.","reach":"unknown","title":"macOS: authentication state flaw lets a remote attacker run code","impact":"high","summary":"An authentication state-management flaw in macOS allows a remote attacker to potentially execute arbitrary code on affected Macs. Apple fixed it in macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker may execute arbitrary code on the Mac.","analyst_note":"Check Apple's security release notes for macOS Golden Gate 27.2 at https://nvd.nist.gov/vuln/detail/CVE-2026-112427 to confirm the affected component, attack vector and whether authentication or user interaction is required.","how_to_check":"- Check the installed macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` in a terminal.\n- Compare the result against `27.2`; anything earlier is unpatched for this issue.","needs_analyst":true,"not_affected_if":["already-on-macos-27.2-or-later"],"who_is_affected":"Any Mac running a macOS release earlier than Golden Gate 27.2 may be affected, per the NVD description. The sources do not describe the specific service or data path that is reachable, so the exact exposure is unknown. Machines already on 27.2 or later are not affected by this issue.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3246,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112427':13A,16A '-2026':12A,15A '27.2':49B,67C 'abl':73C 'address':54C 'affect':40B 'allow':30B 'appl':18B,42B 'apple-devic':17B 'arbitrari':37B,76C 'attack':8A,33B,70C 'authent':2A,23B,51C 'caus':75C 'code':10A,38B,77C 'cve':11A,14A 'devic':19B 'execut':36B,78C 'fix':43B,62C 'flaw':4A,27B 'gate':48B,66C 'golden':47B,65C 'improv':56C 'infrastructur':20B 'issu':52C,60C 'let':5A 'mac':41B 'maco':1A,21B,29B,46B,64C 'manag':26B,58C 'may':71C 'potenti':35B 'remot':7A,32B,69C 'run':9A 'state':3A,25B,57C 'state-manag':24B","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release earlier than Golden Gate 27.2 may be affected, per the NVD description. The sources do not describe the specific service or data path that is reachable, so the exact exposure is unknown. Machines already on 27.2 or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112427","severity":null,"published_at":"2026-10-26T21:17:32+00:00","modified_at":"2026-10-26T21:17:32+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","fetched_at":"2026-10-26T21:20:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}