CVE-2026-28900: Apple macOS Gatekeeper Bypass Vulnerability

CVE-2026-28900 Overview

CVE-2026-28900 is a file quarantine bypass vulnerability in Apple macOS. A maliciously crafted ZIP archive can bypass Gatekeeper checks, allowing untrusted content to execute without the standard origin verification. Apple addressed the issue with additional checks in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The weakness is classified under [CWE-290] (Authentication Bypass by Spoofing) and requires local access with user interaction.

Critical Impact
Attackers can deliver ZIP archives that evade Gatekeeper, enabling execution of unsigned or untrusted code on macOS systems without triggering quarantine prompts.

Affected Products

Apple macOS Sonoma versions prior to 14.8.8
Apple macOS Sequoia versions prior to 15.7.8
Applications relying on Gatekeeper and file quarantine for archive validation

Discovery Timeline

2026-07-27 - CVE-2026-28900 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-28900

Vulnerability Analysis

The vulnerability resides in the macOS file quarantine mechanism that enforces Gatekeeper policy on downloaded content. Gatekeeper inspects files carrying the com.apple.quarantine extended attribute and validates code signatures, notarization status, and user consent before execution. A maliciously crafted ZIP archive can be structured to evade this inspection, allowing embedded content to run without the expected origin checks. The impact is a high-integrity compromise where user-controlled or attacker-supplied binaries can execute outside the intended trust boundary. Apple's fix introduces additional validation checks during archive processing to close the gap.

Root Cause

The root cause is improper propagation of quarantine attributes during ZIP archive extraction. When the archive is crafted in a specific manner, extracted files do not inherit the com.apple.quarantine attribute, or the attribute is applied inconsistently. Gatekeeper therefore treats the extracted payload as trusted local content. This is an authentication bypass by spoofing weakness, since the archive misrepresents the provenance of its contents to the operating system.

Attack Vector

Exploitation requires local file interaction and user action. An attacker delivers the crafted ZIP archive through phishing, drive-by download, removable media, or a compromised software distribution channel. When the target extracts the archive using a vulnerable component, the payload inside bypasses Gatekeeper prompts and executes as if it were locally created content. No elevated privileges are required prior to exploitation, but user interaction is necessary to open or extract the archive.

No verified proof-of-concept code is publicly available for this issue. See the Apple Security Advisory 128071 and Apple Security Advisory 128072 for vendor technical details.

Detection Methods for CVE-2026-28900

Indicators of Compromise

Extracted files from ZIP archives that lack the com.apple.quarantine extended attribute despite originating from network sources
Execution of unsigned or non-notarized binaries shortly after ZIP archive extraction in user Downloads directories
Archive utility or third-party unarchiver processes writing executables that subsequently spawn without Gatekeeper prompts

Detection Strategies

Audit xattr output on newly extracted files under user download and temporary paths to confirm quarantine attributes are present
Correlate ZIP extraction events with subsequent process execution to identify payloads that skipped Gatekeeper validation
Monitor endpoint telemetry for execution of Mach-O binaries, .app bundles, or shell scripts originating from recently unarchived directories

Monitoring Recommendations

Enable Unified Logging subsystem filters for com.apple.syspolicy and com.apple.quarantine to capture Gatekeeper decisions
Forward macOS endpoint logs to a centralized SIEM for correlation of download, extract, and execute sequences
Alert on first-seen binaries executed from Downloads folders without valid Developer ID signatures

How to Mitigate CVE-2026-28900

Immediate Actions Required

Update all macOS Sonoma hosts to version 14.8.8 or later
Update all macOS Sequoia hosts to version 15.7.8 or later
Instruct users to avoid opening ZIP archives from untrusted sources until patches are applied
Verify management tooling (MDM) reports patch compliance across the fleet

Patch Information

Apple released fixes in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. Patch details are available in Apple Security Advisory 128071 and Apple Security Advisory 128072. Deploy updates through Software Update or an enterprise MDM solution.

Workarounds

Restrict extraction of ZIP archives to trusted, first-party archive utilities pending patch deployment
Enforce application allowlisting so that only signed and notarized binaries can execute
Use MDM policies to require Gatekeeper to remain enabled and to block execution of unidentified developers

bash

# Verify installed macOS build meets the patched version
sw_vers -productVersion

# Inspect quarantine attribute on a suspect extracted file
xattr -p com.apple.quarantine /path/to/extracted/file

# Confirm Gatekeeper is enabled
spctl --status