CVE-2026-65369: Apple macOS Gatekeeper Auth Bypass Flaw

CVE-2026-65369 Overview

CVE-2026-65369 is a logic flaw in Apple macOS that allows a malicious application to bypass Gatekeeper checks. Gatekeeper is the macOS security mechanism that verifies application signatures and notarization status before allowing execution. The vulnerability stems from improper state management within Gatekeeper's validation flow, categorized under [CWE-693] Protection Mechanism Failure. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires local access and user interaction, but successful abuse permits execution of unsigned or unnotarized code without triggering standard security prompts.

Critical Impact
A malicious application executed locally can bypass Gatekeeper validation and run code that should have been blocked by macOS signature and notarization enforcement.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-65369 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-65369

Vulnerability Analysis

CVE-2026-65369 is a Gatekeeper bypass rooted in flawed state management during application validation. Gatekeeper enforces code signing and notarization requirements on applications downloaded or executed on macOS. When Gatekeeper's internal state transitions do not correctly track validation results, an attacker can craft an application that reaches an executable state without completing signature verification. Apple's advisory describes the fix as addressing the issue through improved state management, indicating that the pre-patch code path allowed inconsistent state to persist across validation stages. This aligns with [CWE-693] Protection Mechanism Failure, where the security control exists but can be circumvented through unexpected execution paths.

Root Cause

The root cause is inconsistent state handling within Gatekeeper's validation logic. Under specific conditions, the component evaluating whether an application is permitted to run produces an outcome that does not reflect the true signature or notarization status. The fix enforces consistent state transitions so that validation results cannot be desynchronized from enforcement decisions.

Attack Vector

Exploitation requires local delivery of a malicious application and user interaction to launch it. An attacker distributing an unsigned or unnotarized payload can package it in a way that manipulates Gatekeeper's state machine into permitting execution. Because the vulnerability does not require elevated privileges, any user account capable of launching applications can trigger it. No public proof-of-concept exists, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are limited to Apple's advisories; see Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043.

Detection Methods for CVE-2026-65369

Indicators of Compromise

Execution of applications lacking valid Developer ID signatures or notarization tickets on macOS endpoints.
Absence of expected Gatekeeper prompt entries in system.log or the unified logging subsystem when unsigned applications launch.
Unexpected quarantine attribute removal on files under user-writable directories such as ~/Downloads or /tmp.

Detection Strategies

Query endpoint telemetry for process launches where the parent binary lacks a valid codesign verification result.
Correlate application first-execution events with the presence of com.apple.quarantine extended attributes to identify bypassed enforcement.
Monitor for applications executing from non-standard paths shortly after being written to disk by browsers, mail clients, or archive utilities.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework (ESF) events into a centralized analytics platform to track code signing verdicts and Gatekeeper decisions.
Alert on execution of Mach-O binaries and application bundles with missing or invalid signatures.
Track macOS build version distribution across the fleet to identify endpoints running vulnerable releases.

How to Mitigate CVE-2026-65369

Immediate Actions Required

Update all macOS endpoints to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 depending on the supported release track.
Inventory endpoints still running unpatched macOS versions and prioritize them for accelerated update deployment.
Restrict installation of applications from untrusted sources through mobile device management (MDM) policy.

Patch Information

Apple released fixes across three macOS trains. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for release notes and applicable versions. Deploy the appropriate update through Software Update or an MDM solution such as Jamf, Kandji, or Intune.

Workarounds

Enforce the strictest Gatekeeper policy through MDM, allowing execution only for applications from the App Store and identified developers.
Educate users to avoid launching applications received from untrusted channels until endpoints are patched.
Use application allowlisting to restrict execution to approved software while patch deployment is in progress.

bash

# Verify current macOS version and Gatekeeper status
sw_vers -productVersion
spctl --status
spctl --assess --verbose /Applications/ExampleApp.app