---
id: "CVE-2026-112518"
kind: "vulnerability"
aliases: ["CVE-2026-112518"]
title: "Apple OS: signature validation flaw lets attackers impersonate Kerberos KDC"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "infrastructure", "ios", "kerberos", "macos", "windows"]
not_affected_if: ["fixed-release", "no-kerberos"]
published_at: "2026-10-26T21:17:43+00:00"
first_seen_at: "2026-10-26T21:20:27+00:00"
updated_at: "2026-10-26T21:29:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112518", "first_seen_at": "2026-10-26T21:20:27+00:00"}]
---

# Apple OS: signature validation flaw lets attackers impersonate Kerberos KDC

Apple fixed a signature validation issue in its operating systems that lets an attacker in a privileged network position impersonate a Kerberos key distribution center (KDC). The sources do not describe a code execution or data theft path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OS version on each Apple device, for example via Settings > General > About or `sw_vers` on macOS, and compare it to the fixed release.
- Note whether the device or its fleet uses Kerberos authentication against a KDC.

## Fix

- Update iOS and iPadOS to `27.2` or later.
- Update macOS Golden Gate to `27.2` or later.
- Update tvOS, visionOS and watchOS to `27.2` or later.

## Timeline

- 2026-10-26T21:20:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112518

## From the sources

An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_