{"id":"CVE-2026-112518","kind":"vulnerability","aliases":["CVE-2026-112518"],"related":[],"title":"Apple OS: signature validation flaw lets attackers impersonate Kerberos KDC","description":"An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC.","summary":"Apple fixed a signature validation issue in its operating systems that lets an attacker in a privileged network position impersonate a Kerberos key distribution center (KDC). The sources do not describe a code execution or data theft path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","kerberos","macos","windows"],"not_affected_if":["fixed-release","no-kerberos"],"how_to_check":"- Check the OS version on each Apple device, for example via Settings > General > About or `sw_vers` on macOS, and compare it to the fixed release.\n- Note whether the device or its fleet uses Kerberos authentication against a KDC.","fix":"- Update iOS and iPadOS to `27.2` or later.\n- Update macOS Golden Gate to `27.2` or later.\n- Update tvOS, visionOS and watchOS to `27.2` or later.","status":"open","published_at":"2026-10-26T21:17:43+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:29:31+00:00","updated_at":"2026-10-26T21:29:31+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:29:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later.\n- Update macOS Golden Gate to `27.2` or later.\n- Update tvOS, visionOS and watchOS to `27.2` or later.","reach":"network","title":"Apple OS: signature validation flaw lets attackers impersonate Kerberos KDC","impact":"medium","summary":"Apple fixed a signature validation issue in its operating systems that lets an attacker in a privileged network position impersonate a Kerberos key distribution center (KDC). The sources do not describe a code execution or data theft path.","category":"infrastructure","nicknames":[],"who_cares":["apple","macos","ios","kerberos","windows"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker impersonates a Kerberos KDC from a privileged network position","analyst_note":"Check the Apple security advisory and the NVD entry for the affected component, the required network position and whether Kerberos auth is involved by default.","how_to_check":"- Check the OS version on each Apple device, for example via Settings > General > About or `sw_vers` on macOS, and compare it to the fixed release.\n- Note whether the device or its fleet uses Kerberos authentication against a KDC.","needs_analyst":true,"not_affected_if":["fixed-release","no-kerberos"],"who_is_affected":"Apple devices running the affected releases are the ones named in the advisory, and the issue matters most where those devices authenticate to Kerberos services over a network an attacker can reach. Teams that do not use Kerberos on their Apple devices, or that run only on fixed releases, can deprioritise it. The sources do not say which Kerberos configurations are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3304,"output_tokens":627,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112518':13A,16A '-2026':12A,15A '27.2':77C,80C,84C,86C,88C,90C 'abl':100C 'address':67C 'appl':1A,17B,23B 'attack':7A,36B,92C 'center':47B 'check':70C 'code':55B 'cve':11A,14A 'data':58B 'describ':53B 'distribut':46B 'execut':56B 'fix':24B,74C 'flaw':5A 'gate':83C 'golden':82C 'imperson':8A,42B,102C 'improv':69C 'infrastructur':18B 'io':19B,76C 'ipado':79C 'issu':28B,62C,72C 'kdc':10A,48B,105C 'kerbero':9A,20B,44B,104C 'key':45B 'let':6A,34B 'maco':21B,81C 'may':98C 'network':40B,96C 'oper':31B 'os':2A 'path':60B 'posit':41B,97C 'privileg':39B,95C 'signatur':3A,26B,64C 'sourc':50B 'system':32B 'theft':59B 'tvos':85C 'valid':4A,27B,65C 'visiono':87C 'watcho':89C 'window':22B","nicknames":[],"mitigations":[],"who_affected":"Apple devices running the affected releases are the ones named in the advisory, and the issue matters most where those devices authenticate to Kerberos services over a network an attacker can reach. Teams that do not use Kerberos on their Apple devices, or that run only on fixed releases, can deprioritise it. The sources do not say which Kerberos configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112518","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112518","severity":null,"published_at":"2026-10-26T21:17:43+00:00","modified_at":"2026-10-26T21:17:43+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}