CVE-2026-65399 Overview
CVE-2026-65399 is a file quarantine bypass affecting multiple Apple operating systems. A crafted archive can evade Gatekeeper enforcement, allowing files extracted from the archive to execute without the standard quarantine attribute checks that normally gate untrusted content. Apple addressed the issue with additional validation checks in the file quarantine mechanism. The weakness maps to [CWE-290] Authentication Bypass by Spoofing, and requires local access with low privileges to exploit. Apple has released patches across iOS, iPadOS, macOS, visionOS, and watchOS. The flaw impacts confidentiality and integrity at a limited scope with no availability impact.
Critical Impact
An attacker who convinces a user to open a specially constructed archive can bypass Gatekeeper on macOS and related Apple platforms, enabling execution of unsigned or unnotarized content.
Affected Products
- Apple iOS and iPadOS (fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27)
- Apple macOS (fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27)
- Apple visionOS 27 and watchOS 27
Discovery Timeline
- 2026-09-14 - CVE-2026-65399 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-65399
Vulnerability Analysis
Gatekeeper enforces code-signing and notarization policy on files that carry the com.apple.quarantine extended attribute. Files downloaded through browsers, mail clients, or messaging apps typically inherit this attribute so macOS can prompt the user before execution. CVE-2026-65399 breaks that invariant: an archive can be crafted so that the extraction process does not propagate quarantine metadata to the extracted contents. As a result, embedded executables, scripts, or bundles run without the origin checks Gatekeeper is designed to enforce. The vulnerability is classified as an authentication bypass by spoofing because the attacker manipulates the trust signal used by the operating system to distinguish trusted from untrusted content.
Root Cause
The root cause is incomplete propagation of the quarantine extended attribute during archive expansion. Apple's fix adds additional checks to ensure quarantine state is preserved for files unpacked from archives, closing the gap that let crafted archives strip or omit the attribute.
Attack Vector
Exploitation requires local access with low privileges and no user interaction beyond opening the archive. An attacker delivers the archive through phishing, drive-by download, or shared storage. When the user extracts the archive, the payload runs without triggering Gatekeeper warnings. The vulnerability manifests in the quarantine attribute inheritance logic during archive extraction. See the vendor advisories for technical specifics.
Detection Methods for CVE-2026-65399
Indicators of Compromise
- Executable files, .app bundles, or scripts on disk that lack the com.apple.quarantine extended attribute but originated from a downloaded archive.
- Process launches of unsigned or ad-hoc signed binaries from user-writable paths such as ~/Downloads or /tmp without a preceding Gatekeeper prompt.
- Archive files (.zip, .tar, .dmg, custom formats) received from external sources followed by rapid child-process creation.
Detection Strategies
- Audit extended attributes on files extracted from archives using xattr -l and flag missing quarantine attributes on content originating from network sources.
- Correlate archive extraction events with subsequent execution of extracted binaries in EDR telemetry to identify Gatekeeper bypass patterns.
- Monitor Unified Logs for syspolicyd and LaunchServices events that indicate execution of content without a corresponding Gatekeeper assessment.
Monitoring Recommendations
- Enable endpoint telemetry that captures process ancestry, code signing status, and quarantine attribute state for newly written files.
- Track archive utilities such as ditto, unzip, tar, and third-party extractors as potential entry points for bypass payloads.
- Alert on execution of newly created binaries within minutes of an archive being written to disk from a browser or messaging application.
How to Mitigate CVE-2026-65399
Immediate Actions Required
- Install the vendor updates: iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27, and watchOS 27.
- Prioritize macOS endpoints in the update rollout since Gatekeeper is the primary enforcement surface affected.
- Communicate to users that archives from untrusted sources should not be opened until patching is complete.
Patch Information
Apple has released fixes across all affected platforms. Refer to the vendor advisories for version details and release notes: Apple Support Document #149034, Apple Support Document #149035, Apple Support Document #149037, Apple Support Document #149038, Apple Support Document #149041, Apple Support Document #149042, and Apple Support Document #149043.
Workarounds
- Restrict use of third-party archive extraction utilities and standardize on Apple's built-in Archive Utility with current patches applied.
- Configure endpoint policy to block execution of unsigned binaries launched from user download directories.
- Educate users to inspect files with xattr -l before executing content extracted from archives received over email or messaging platforms.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
