CVE-2026-28854: macOS Golden Gate 27 Auth Bypass Vulnerability

CVE-2026-28854 Overview

CVE-2026-28854 is a code signing and integrity validation flaw in Apple macOS. The issue allows a maliciously modified application to launch despite tampering with the app bundle. Apple addressed the weakness by adding further app bundle integrity checks in macOS Golden Gate 27.

The vulnerability affects the macOS runtime that validates application bundles before execution. An attacker who modifies a legitimate signed application can retain the ability to run it on a vulnerable host. This undermines Gatekeeper assumptions that depend on bundle integrity to block tampered binaries.

Critical Impact
A maliciously modified app may not be prevented from launching on affected macOS systems, weakening Gatekeeper and code signing protections.

Affected Products

Apple macOS versions prior to macOS Golden Gate 27
macOS application bundle integrity validation subsystem
Workflows relying on Gatekeeper to block tampered signed apps

Discovery Timeline

2026-10-20 - CVE-2026-28854 published to the National Vulnerability Database
2026-10-20 - Last updated in the NVD database

Technical Details for CVE-2026-28854

Vulnerability Analysis

The flaw resides in macOS code that evaluates the integrity of an application bundle before launch. The validation routine does not fully detect certain modifications made to a signed application bundle. As a result, a tampered binary can execute even though its contents no longer match the original signature expectations.

Apple's advisory describes the fix as the addition of further app bundle integrity checks. This indicates the pre-patch validation path missed one or more inputs that should have invalidated the bundle. The weakness falls under improper validation of code signing and bundle integrity.

The practical outcome is a Gatekeeper and runtime trust bypass. Users and administrators who rely on signature verification to detect modified software lose that assurance. The flaw does not require remote network access to exploit.

Root Cause

The root cause is incomplete integrity verification of macOS application bundles during launch. Specific resources, metadata, or structural elements within the bundle are not fully covered by the pre-launch validation checks. Modifications to those elements do not trigger a launch denial.

Attack Vector

Exploitation requires an attacker to deliver a modified app bundle to the target system. Common delivery paths include trojanized installers, supply chain tampering, or local modification after initial access. Once delivered, the modified bundle launches without being blocked by the integrity enforcement that the pre-patch macOS version performs.

No verified public exploit or proof-of-concept code is referenced in the advisory. See the Apple Support Article for official technical details.

Detection Methods for CVE-2026-28854

Indicators of Compromise

Signed .app bundles whose on-disk resources or Info.plist differ from the originally shipped vendor artifact
Execution of applications from non-standard paths such as /tmp, /private/var/folders, or user Downloads directories
codesign --verify --deep --strict failures on applications that still launch successfully

Detection Strategies

Baseline hashes of trusted application bundles and alert on drift against vendor-published values
Monitor process execution telemetry for launches of modified Apple-signed or notarized applications
Correlate Gatekeeper and XProtect log events with endpoint execution events to surface validation anomalies

Monitoring Recommendations

Collect macOS Unified Log entries from the com.apple.securityd and com.apple.syspolicy subsystems
Track installations and modifications under /Applications and ~/Applications with file integrity monitoring
Review endpoint detection and response telemetry for unsigned child processes spawned by otherwise trusted apps

How to Mitigate CVE-2026-28854

Immediate Actions Required

Upgrade all affected macOS systems to macOS Golden Gate 27 or later
Audit installed application bundles for integrity drift against vendor-shipped versions
Restrict installation of applications to administrator-approved sources via mobile device management policy

Patch Information

Apple fixed CVE-2026-28854 in macOS Golden Gate 27 by adding additional app bundle integrity checks. Administrators should deploy the update through Software Update or their managed device platform. Reference: Apple Support Article 149035.

Workarounds

Enforce Gatekeeper in its strictest configuration and disallow user override of unsigned or modified applications
Use application allowlisting to restrict execution to known-good bundle hashes
Remove local administrator rights from standard users to limit tampering with installed app bundles

bash

# Verify bundle integrity on a macOS endpoint
codesign --verify --deep --strict --verbose=2 /Applications/Example.app
spctl --assess --type execute --verbose /Applications/Example.app

# Confirm the installed macOS version meets the patched release
sw_vers -productVersion