Description
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
Published: 2026-07-27
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A file quarantine bypass in macOS Gatekeeper occurs when a maliciously crafted ZIP archive may bypass Gatekeeper checks. The issue has been addressed in selected macOS releases (Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.5). The bypass allows the system to treat the archive as compliant, potentially enabling execution of malicious code without user awareness. This weakness corresponds to CWE‑290 (Authorization Bypass) and CWE‑693 (Security Misconfiguration).

Affected Systems

Vulnerable systems are macOS Sequoia, Sonoma, and Tahoe. The issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5. Users operating earlier releases may be affected, including all builds prior to those patch releases. The advisory lists only the three major macOS versions, so all legacy releases before the stated patch versions are considered at risk.

Risk and Exploitability

The CVSS score is 5.5, reflecting moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV, meaning no widespread exploitation has been observed. Nonetheless, a malicious ZIP archive can still bypass Gatekeeper and allow execution of unwanted code if a user opens it, presenting an elevated risk to system integrity on non‑patched macOS systems.

Generated by OpenCVE AI on August 26, 2026 at 05:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8 to eliminate the vulnerability.
  • Avoid opening ZIP archives from untrusted or unknown sources; consider inspecting archives in a sandboxed environment before extraction.
  • Ensure Gatekeeper is fully enabled and set to allow apps only from the App Store or identified developers; verify these settings in Security & Privacy. This addresses the authorization bypass (CWE‑290) and security misconfiguration (CWE‑693) weaknesses.

Generated by OpenCVE AI on August 26, 2026 at 05:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Gatekeeper Quarantine Bypass via Malicious ZIP Archive in macOS

Tue, 25 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks. A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
References

Wed, 05 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Gatekeeper Quarantine Bypass via Malicious ZIP Archive in macOS

Wed, 05 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title File Quarantine Bypass via Malicious ZIP in macOS Gatekeeper
Weaknesses CWE-284

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title File Quarantine Bypass via Malicious ZIP in macOS Gatekeeper
Weaknesses CWE-284
CWE-290
CWE-693
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-25T19:24:57.448Z

Reserved: 2026-03-03T16:36:03.983Z

Link: CVE-2026-28900

cve-icon Vulnrichment

Updated: 2026-07-28T15:20:22.596Z

cve-icon NVD

Status : Modified

Published: 2026-07-27T21:16:49.080

Modified: 2026-08-25T20:16:53.880

Link: CVE-2026-28900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T05:15:04Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing

  • CWE-693

    Protection Mechanism Failure