CVE-2026-64708: Apple macOS Gatekeeper Bypass Vulnerability

CVE-2026-64708 Overview

CVE-2026-64708 is a file quarantine bypass vulnerability in Apple macOS that allows a malicious application to circumvent Gatekeeper checks. Apple addressed the flaw with additional validation checks in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The weakness is classified under [CWE-693] (Protection Mechanism Failure) and requires local access with user interaction. Successful exploitation lets an unsigned or improperly notarized application execute despite the quarantine attribute being present.

Critical Impact
An app may bypass Gatekeeper checks, allowing untrusted code to run on macOS systems without triggering the expected user consent and signature verification workflow.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64708 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64708

Vulnerability Analysis

The vulnerability affects the macOS file quarantine subsystem, which works with Gatekeeper to enforce code signature and notarization checks on downloaded content. The quarantine attribute (com.apple.quarantine) is applied to files that originate from untrusted sources such as browsers, email clients, and messaging apps. Gatekeeper consults this attribute before permitting execution and prompts the user when appropriate.

The defect allowed a crafted application to sidestep this policy enforcement. When triggered, macOS did not perform the expected verification steps against the quarantined content, permitting the payload to execute as if it were locally trusted. This weakens a core defense-in-depth mechanism intended to block Trojanized applications and unsigned binaries delivered through common distribution channels.

Root Cause

The root cause is a missing or insufficient check in the quarantine enforcement path, categorized as [CWE-693] Protection Mechanism Failure. Apple's fix introduces additional checks to ensure quarantined content is fully evaluated by Gatekeeper before execution is permitted.

Attack Vector

Exploitation requires local delivery of a crafted application and user interaction to launch it. An attacker typically distributes the malicious app via download, archive extraction, or removable media. Once the user opens the file, the missing check lets the app execute without the standard Gatekeeper dialog or signature verification.

No verified proof-of-concept code is available. Refer to Apple's advisories for authoritative technical details: Apple Support Document #128067, Apple Support Document #128071, and Apple Support Document #128072.

Detection Methods for CVE-2026-64708

Indicators of Compromise

Applications executing from user download directories without a corresponding Gatekeeper approval event in system.log or the Unified Log.
Files missing the expected com.apple.quarantine extended attribute after download from a browser or messaging client.
Unsigned or ad-hoc signed Mach-O binaries launching child processes shortly after archive extraction.

Detection Strategies

Hunt for xattr invocations that remove or alter the com.apple.quarantine attribute on user-writable paths.
Correlate LaunchServices and syspolicyd events with process execution to identify apps that ran without a policy assessment.
Baseline first-seen application executions per host and alert on unsigned binaries launched from ~/Downloads, /tmp, or mounted disk images.

Monitoring Recommendations

Ingest macOS Endpoint Security telemetry (ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MOUNT) into your SIEM for centralized review.
Monitor code signature validation failures and Gatekeeper assessment outcomes reported by syspolicyd.
Track disk image (.dmg) and archive (.zip) mount and extraction events followed by immediate binary execution from the same path.

How to Mitigate CVE-2026-64708

Immediate Actions Required

Upgrade macOS endpoints to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 as applicable to the installed major version.
Inventory macOS fleet versions and prioritize systems that handle downloaded content from external sources.
Restrict installation of applications from unmanaged sources through MDM configuration profiles.

Patch Information

Apple has released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Full remediation details are in Apple Support Document #128067, Apple Support Document #128071, and Apple Support Document #128072.

Workarounds

Enforce Gatekeeper policy via MDM to allow only apps from the App Store and identified developers.
Block execution of applications launched from removable media and disk images via endpoint policy.
Educate users to avoid opening applications delivered outside sanctioned software distribution channels.

bash

# Verify Gatekeeper is enabled and enforce App Store & identified developer policy
sudo spctl --master-enable
spctl --status

# Inspect quarantine attribute on a downloaded file
xattr -p com.apple.quarantine /path/to/downloaded.app

# Confirm installed macOS version meets the patched baseline
sw_vers -productVersion