Computer Repair · November 6, 2026 · ComputerKing Team

A macOS Flaw Lets an App Gain Root — and Exploit Code Is Now Public: Match Your Version to 27.2 / 26.7.2 / 15.8.2 and Do These 3 Things Before Updating

On 26 October 2026 Apple fixed CVE-2026-112487 in macOS 27.2, 26.7.2 and 15.8.2: an app already running on a Mac could gain root privileges. On 31 October a public proof of concept appeared on GitHub. This guide shows how to check your version, the three steps to take before updating, and how to stay safe if you cannot update yet.

Key points

On 26 October 2026, Apple fixed a vulnerability tracked as CVE-2026-112487 in macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2: an app already running on a Mac could gain root privileges. On 31 October, a public proof of concept (PoC) appeared on GitHub, written by one of the researchers Apple credits. That does not mean anyone has been attacked — Apple has said no such thing, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog — but once exploit code is public, putting off the update carries a different risk. This guide shows how to match your version, the three steps to take before updating, and how to stay safe if you cannot update yet. Individual quotation required for any service.

1. What happened: a local privilege-escalation flaw, plus a public PoC

First, be precise about what this flaw is, so the story does not grow in retelling:

• The flaw itself. Apple lists it under the Storage component, describing it as "a path handling issue was addressed with improved validation." The impact line reads: "An app may be able to gain root privileges." In other words, an attacker first needs a way to run code on your Mac before this flaw is usable — it is a second-stage bug, not a click-a-link-and-you-are-in attack.
• The proof of concept. On 31 October, a public PoC appeared on GitHub. Its author, Lyutoon, is one of the researchers Apple credits. The PoC reportedly contains a README, Objective-C source and a demo video, claiming a working root escalation on macOS 26.6 with System Integrity Protection enabled. The reporting outlet did a read-only review, found no binaries or downloaders in it, and did not execute it — and neither will we reproduce any steps here.
• A disagreement worth stating. The PoC author attributes the bug to the Document Revisions service (revisiond), but Apple does not name that service in its advisory. Do not treat the author's inference as Apple's statement.
• The same batch fixed more. The 26 October updates also fixed two other root-class macOS bugs, CVE-2026-112545 (configd) and CVE-2026-113900 (Crash Reporter). As far as is known, neither of those has a public PoC.

How this differs from Article 144 on this site: Article 144 is the macOS 27.2 release overview — 263 security fixes, with the message "do not rush, check your version first." This article is a follow-up on a single vulnerability: exploit code is now public, so the focus shifts to matching your version, patching promptly, and not installing untrusted software in the meantime. Different angle, not a repeat.

2. Which Macs are affected: a three-line version check

Macs running these versions are affected:

• macOS Golden Gate: before 27.2
• macOS Tahoe: before 26.7.2
• macOS Sequoia: before 15.8.2

The fixed versions are 27.2, 26.7.2 and 15.8.2, all released on 26 October 2026. The key point: you do not need to jump to the newest major release for this fix — a Mac staying on Sequoia gets the fix in 15.8.2, and one staying on Tahoe gets it in 26.7.2.

To check your version: click the Apple menu at the top left, then "About This Mac" — the first line shows the macOS name and version. Compare it against the three lines above: if your number is below the fixed version for your line, you are in the group that needs the update.

3. Four things not to misread

• A public PoC does not mean people have been attacked. Apple has made no statement about exploitation in the wild, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog. A public PoC means the barrier to attack is lower — not that a large-scale attack has happened.
• Do not trust severity numbers circulating online. NVD lists this CVE as Awaiting Analysis and has not scored it; Apple publishes no score either. Any number quoted for it right now is a guess.
• This is a second-stage flaw. An attacker first needs code running on your Mac — for example, an app of unknown origin that you installed. That is why "do not install random software" is not a platitude here; it is the first line of defence for this exact flaw.
• Do not panic-update without a backup. Wrecking your data by rushing an update is just as bad as putting the update off. The next section covers the three steps first.

4. Three steps before updating

1. Back up first, and confirm the backup finished before updating. Run a full Time Machine backup and wait until it reports completion. A backup is not a ritual; it is the only way to walk away whole if the update goes wrong. Article 79 on this site has a full backup strategy for Hong Kong users.

2. Match the version, and set aside time and power. Check which line you are on and which fixed version you need, as in section 2. Plug in the power adapter and set aside at least an hour. Do not start half an hour before a deadline or a meeting.

3. Verify after updating. Go back to "About This Mac" and confirm the version really is 27.2, 26.7.2 or 15.8.2. Do not rely on "your system is up to date" alone — seeing the version number yourself is what counts.

5. If you cannot update yet, how to stay safe

Some users cannot update immediately — for example, a company-owned machine, or older software waiting on compatibility. Until you can update:

• Do not install apps of unknown origin. Download only from the Mac App Store or the official website of a developer you recognise. This flaw needs code running on your Mac first, so tightening download sources tightens the entry point.
• Do not download a so-called "checker tool" because of this news. Tools claiming to check whether you are affected will appear quickly online, and a checker of unknown origin is itself one of the most common infection routes.
• For company Macs, check the fleet. Small businesses should list which Macs are still below the fixed versions, not just the one on your own desk. If a machine has gone un-updated for a long time, ask which step in the process stopped.
• Do not download or run the PoC from GitHub yourself. Even the reporting outlet did not execute it. It is not a detection tool, it will not tell you whether your Mac is safe, and it only puts the machine at risk.

6. Before asking for help, prepare this checklist

If you decide to get help, having this ready will make it much faster:

• Mac model and year, and the macOS version currently installed.
• Whether you have a backup, where it is, and when the last successful backup was.
• Whether you recently installed any app of unknown origin, or clicked a suspicious link.
• Any error message seen during the update — photograph it if one appears.

On pricing: this article gives no prices. Actual charges require an individual quotation, depending on the Mac model, version and the work involved.

Sources

• ThreatWire report: macOS CVE-2026-112487: Storage flaw to root, public PoC, update now (1 November 2026): https://www.threatwire.tech/news/update-macos-now-public-exploit-code-turns-storage-flaw-cve-2026-112487-into-root
• Article 144 on this site, macos-27-2-security-update-verify-installed-guide: macOS 27.2 overview, 263 security fixes
• Article 71 on this site, macos-sequoia-tahoe-security-updates-stay-put-guide: staying on Sequoia or Tahoe and still getting security updates
• Article 79 on this site, backup-strategy-hk: backup strategy for Hong Kong users

Related articles

• macos-27-2-security-update-verify-installed-guide
• macos-sequoia-tahoe-security-updates-stay-put-guide
• backup-strategy-hk