CVE-2026-84570: Apple macOS Gatekeeper Auth Bypass Flaw

CVE-2026-84570 Overview

CVE-2026-84570 is a logic flaw in Apple macOS that allows a local application to bypass Gatekeeper checks. Gatekeeper is the macOS security feature that enforces code signing and notarization requirements on downloaded and executed software. Apple addressed the issue with improved checks in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability is classified under [CWE-693] Protection Mechanism Failure and requires local access with low privileges to exploit. No user interaction is required, and the flaw can compromise both confidentiality and integrity of the affected system.

Critical Impact
A local application can bypass Gatekeeper enforcement, enabling execution of unsigned or unnotarized code that would otherwise be blocked by macOS security controls.

Affected Products

Apple macOS Golden Gate (prior to version 27)
Apple macOS Sequoia (prior to version 15.8)
Apple macOS Tahoe (prior to version 26.7)

Discovery Timeline

2026-09-14 - CVE-2026-84570 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84570

Vulnerability Analysis

CVE-2026-84570 is a Gatekeeper bypass rooted in a logic error within macOS security validation. Gatekeeper is designed to verify the code signature and notarization status of applications before they run. When enforcement logic contains gaps, an attacker-controlled app can present itself in a way that circumvents these checks. Apple's advisory describes the fix as "a logic issue was addressed with improved checks," indicating that the underlying validation path did not correctly evaluate all conditions before permitting execution.

The vulnerability requires local access. An attacker must already have the ability to run code or deliver a crafted application to the target system. Once triggered, the flaw allows execution of code that bypasses Apple's trust model, reducing the effectiveness of macOS platform defenses against unsigned binaries and untrusted developers.

Root Cause

The root cause is a Protection Mechanism Failure [CWE-693] in the Gatekeeper validation flow. Specific code paths did not enforce all required checks, allowing an application to be treated as trusted when it should not have been. Apple's remediation strengthened the conditional logic that governs when Gatekeeper permits an app to execute.

Attack Vector

Exploitation requires local, low-privileged access to the affected macOS host. An attacker with an existing foothold, or a user who runs a malicious application delivered through phishing or supply-chain channels, can leverage this flaw. Because no user interaction is required beyond the initial execution context, the bypass can be chained with other techniques such as malicious installers, macro-laden documents, or trojanized software distributions to achieve broader compromise. Technical details of the exploitation mechanism are not published in the vendor advisory. Refer to Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043 for vendor-provided information.

Detection Methods for CVE-2026-84570

Indicators of Compromise

Execution of applications lacking valid Developer ID signatures or notarization tickets on hosts running vulnerable macOS versions.
Unexpected entries in /var/db/SystemPolicy or anomalies in syspolicyd logs indicating skipped or short-circuited Gatekeeper evaluations.
Quarantine attribute (com.apple.quarantine) manipulation or removal on newly delivered binaries prior to execution.

Detection Strategies

Monitor process execution telemetry for unsigned or ad-hoc-signed binaries launched from user-writable directories such as ~/Downloads, ~/Library, and /tmp.
Correlate syspolicyd and XProtect log activity with process launches to identify apps executed without a corresponding assessment event.
Alert on child processes spawned by installer packages that were not notarized or that bypassed the standard Gatekeeper prompt flow.

Monitoring Recommendations

Ingest macOS Unified Logs and endpoint process telemetry into a centralized analytics platform for retrospective hunting.
Track macOS version distribution across the fleet and prioritize monitoring on hosts still running versions prior to macOS Sequoia 15.8 and Tahoe 26.7.
Review software installation events and flag deployments originating outside approved distribution channels or the Mac App Store.

How to Mitigate CVE-2026-84570

Immediate Actions Required

Update all affected endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as applicable to each device's supported track.
Restrict local user privileges and enforce the principle of least privilege to limit the pool of attackers who can meet the local access precondition.
Audit installed applications for unsigned or unnotarized binaries and remove those without a verified provenance.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Deploy the update via Software Update or MDM. Full vendor details are available in Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043.

Workarounds

No official workaround is published by Apple; patching is the only supported remediation.
Enforce application allowlisting through MDM policies to restrict execution to approved, signed applications until updates are deployed.
Configure Gatekeeper to its strictest setting (spctl --master-enable) and disallow execution of applications from unidentified developers.

bash

# Verify macOS version and Gatekeeper status
sw_vers -productVersion
spctl --status

# Enforce Gatekeeper (requires admin)
sudo spctl --master-enable

# Trigger system update check
sudo softwareupdate -l
sudo softwareupdate -ia --restart