Live › vulnerability › CVE-2026-112518
Go to dashboardApple fixed a signature validation issue in its operating systems that lets an attacker in a privileged network position impersonate a Kerberos key distribution center (KDC). The sources do not describe a code execution or data theft path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Apple devices running the affected releases are the ones named in the advisory, and the issue matters most where those devices authenticate to Kerberos services over a network an attacker can reach. Teams that do not use Kerberos on their Apple devices, or that run only on fixed releases, can deprioritise it. The sources do not say which Kerberos configurations are exposed.
No product ranges from the sources yet.
sw_vers on macOS, and compare it to the fixed release.27.2 or later.27.2 or later.27.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC.
This page as .md · .json · in your agent: get_signal("CVE-2026-112518")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.