CVE-2026-65383: Apple macOS Gatekeeper Auth Bypass Flaw

CVE-2026-65383 Overview

CVE-2026-65383 is a Gatekeeper bypass vulnerability affecting Apple macOS. A local application can circumvent Gatekeeper checks, allowing unsigned or untrusted code to run without triggering the expected security warnings. Apple addressed the flaw with improved checks in macOS Golden Gate 27. The weakness is categorized under [CWE-284] Improper Access Control and carries a medium severity rating. Exploitation requires local access with low privileges and no user interaction. No public proof-of-concept code or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
A local application can bypass Gatekeeper enforcement on macOS, enabling execution of code that would otherwise be blocked from running on the system.

Affected Products

Apple macOS versions prior to Golden Gate 27
Systems relying on Gatekeeper for application allow-listing
macOS endpoints without the corresponding security update applied

Discovery Timeline

2026-09-14 - CVE-2026-65383 published to the National Vulnerability Database
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-65383

Vulnerability Analysis

Gatekeeper is the macOS subsystem that verifies downloaded applications against Apple notarization and code-signing requirements before allowing them to execute. CVE-2026-65383 breaks that enforcement path. An application running locally can perform actions that bypass Gatekeeper validation, defeating a control designed to prevent untrusted code from running.

Apple's advisory states the issue was resolved with improved checks, indicating the previous logic did not sufficiently validate a condition or attribute before permitting execution. The flaw affects confidentiality and integrity at a limited scope but does not impact availability.

Root Cause

The root cause is improper access control [CWE-284] within Gatekeeper's validation logic. Insufficient checks allowed a local application to reach a code path where notarization or signing enforcement was skipped or trusted incorrectly. Apple's fix strengthens the validation checks to close this gap.

Attack Vector

An attacker requires local access to the target macOS system with low privileges. No user interaction is needed. The attacker delivers or stages a crafted application that leverages the flawed validation path, causing Gatekeeper to approve execution of code that should have been quarantined or blocked. This vulnerability is most useful as a post-initial-access technique to run additional untrusted payloads without triggering standard macOS warnings.

No verified public exploit code is available. Refer to the Apple Support Article for vendor-provided details.

Detection Methods for CVE-2026-65383

Indicators of Compromise

Execution of applications lacking valid Developer ID signatures or notarization tickets on hosts running unpatched macOS builds
Modification or removal of com.apple.quarantine extended attributes on files sourced from external locations
Unexpected child processes launched by browsers, mail clients, or archive utilities without corresponding Gatekeeper prompts

Detection Strategies

Audit spctl --assess results on newly executed binaries and flag applications that ran despite failing assessment
Monitor Endpoint Security framework events for process executions where quarantine attributes are stripped prior to launch
Correlate syspolicyd log entries with process creation telemetry to identify approvals that bypass expected notarization checks

Monitoring Recommendations

Track macOS version inventory to identify endpoints not yet upgraded to macOS Golden Gate 27
Alert on execution of unsigned Mach-O binaries from user-writable paths such as ~/Downloads and /tmp
Baseline normal Gatekeeper prompt frequency and investigate hosts where prompt rates drop unexpectedly

How to Mitigate CVE-2026-65383

Immediate Actions Required

Upgrade affected endpoints to macOS Golden Gate 27 or later as published in the Apple advisory
Inventory macOS assets and prioritize patching for systems that handle untrusted downloads or developer workflows
Review installed applications for unsigned or non-notarized binaries and remove any that are not required

Patch Information

Apple resolved CVE-2026-65383 in macOS Golden Gate 27 with improved checks in the Gatekeeper validation logic. Full details are published in the Apple Support Article. Apply the update through System Settings > General > Software Update, or via managed software update workflows in MDM.

Workarounds

Restrict local user privileges to limit the ability to stage and execute untrusted applications
Enforce application allow-listing through mobile device management (MDM) policies that explicitly approve permitted binaries
Ensure the quarantine attribute is preserved on downloaded content and block execution of files that fail spctl assessment

bash

# Verify current macOS build and Gatekeeper assessment status
sw_vers -productVersion
spctl --status
spctl --assess --verbose=4 /Applications/ExampleApp.app