CVE-2026-28849: Apple macOS Gatekeeper Bypass Vulnerability

CVE-2026-28849 Overview

CVE-2026-28849 is a Gatekeeper bypass vulnerability in Apple macOS. A maliciously crafted ZIP archive can evade Gatekeeper checks, allowing unsigned or untrusted code to execute without the standard quarantine and notarization enforcement. Apple addressed the flaw with improved checks in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The weakness is classified as [CWE-290] Authentication Bypass by Spoofing. Exploitation requires local delivery of the archive and user interaction to open it. Successful abuse compromises code integrity on the target system without directly impacting confidentiality or availability.

Critical Impact
A crafted ZIP archive bypasses Gatekeeper enforcement on macOS Sequoia and Sonoma, enabling execution of unverified code following user interaction.

Affected Products

Apple macOS Sonoma prior to 14.8.8
Apple macOS Sequoia prior to 15.7.8
Systems relying on Gatekeeper quarantine enforcement for ZIP-delivered payloads

Discovery Timeline

2026-07-27 - CVE-2026-28849 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-28849

Vulnerability Analysis

Gatekeeper is the macOS subsystem that verifies code signatures, notarization status, and quarantine attributes before permitting execution of downloaded content. CVE-2026-28849 stems from insufficient validation when macOS processes certain ZIP archive structures. An attacker who crafts a ZIP with specific archive characteristics can cause extracted content to reach the user without the expected Gatekeeper prompts or execution blocks. The vulnerability sits at the intersection of archive parsing and quarantine attribute propagation. It does not disclose data or crash the system, but it undermines a core code-integrity control on macOS. Apple's fix introduces improved checks during archive handling to preserve Gatekeeper enforcement on extracted items.

Root Cause

The root cause is improper trust decision logic during ZIP extraction. Files inside the crafted archive do not consistently inherit the com.apple.quarantine extended attribute, or Gatekeeper's spoofable check accepts the archive contents as trusted. This maps to [CWE-290], where an authentication or trust check can be bypassed through crafted input.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted ZIP archive by email, messaging, drive-by download, or removable media. When the victim opens the archive and launches its contents, Gatekeeper fails to enforce the notarization or signature policy. The payload then executes with the privileges of the current user, providing an initial foothold for further post-exploitation activity such as persistence or credential theft.

No public proof-of-concept or exploit code is available for CVE-2026-28849 at the time of publication. The vulnerability mechanism is described in Apple's advisories referenced below. See Apple Support Document 128071 and Apple Support Document 128072 for vendor details.

Detection Methods for CVE-2026-28849

Indicators of Compromise

Executables launched from user-writable paths such as ~/Downloads or /tmp without corresponding Gatekeeper assessment events in system.log
Files extracted from ZIP archives that lack the com.apple.quarantine extended attribute despite originating from the internet
Unexpected child processes spawned by Archive Utility (bomArchiveHelper) or unzip shortly after archive download

Detection Strategies

Monitor for xattr -d com.apple.quarantine invocations and for files missing quarantine attributes that were sourced from browsers or mail clients
Correlate LSQuarantineEvent records in ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 against subsequent process executions to spot missing Gatekeeper checks
Baseline expected archive extraction utilities and alert on unsigned binaries executing immediately after ZIP extraction

Monitoring Recommendations

Ingest Endpoint Security framework telemetry covering ES_EVENT_TYPE_NOTIFY_EXEC and quarantine attribute changes into your SIEM
Track macOS version inventory to identify hosts still running versions prior to 14.8.8 or 15.7.8
Alert on syspolicyd errors or unusually low volumes of Gatekeeper assessment events on internet-facing user endpoints

How to Mitigate CVE-2026-28849

Immediate Actions Required

Update all macOS Sonoma hosts to 14.8.8 and all macOS Sequoia hosts to 15.7.8 or later
Verify patch deployment using MDM compliance reporting and prioritize endpoints handling untrusted archives
Restrict execution of binaries extracted from ZIP archives originating outside trusted domains until patched

Patch Information

Apple released fixes in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. Refer to Apple Support Document 128071 for Sonoma and Apple Support Document 128072 for Sequoia. The updates introduce improved checks in the archive handling path that preserve Gatekeeper enforcement on extracted content.

Workarounds

Instruct users to avoid opening ZIP archives from untrusted senders until the update is applied
Enforce allowlisting of signed and notarized applications through configuration profiles or third-party application control
Route inbound archives through a sandboxed inspection gateway that extracts and rescans contents before delivery to endpoints

bash

# Verify installed macOS version and confirm patched build
sw_vers -productVersion

# Inspect quarantine attribute on a suspect file
xattr -p com.apple.quarantine /path/to/extracted/file

# Force a Gatekeeper assessment on an application bundle
spctl --assess --verbose=4 /path/to/App.app