CVE-2026-28899

CVE-2026-28899 is a logic flaw in Apple's Gatekeeper security mechanism on macOS that allows a malicious app to bypass Gatekeeper's validation checks. Gatekeeper normally verifies that downloaded apps are notarized and signed before allowing them to run; a bypass means an attacker-controlled app downloaded to a victim's Mac could execute without passing those checks or triggering the standard user-approval flow. Successful exploitation gives an attacker a way to launch untrusted code on target machines, which is typically used as an initial-access step that is chained with other flaws to escape sandboxes or gain elevated privileges. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.6, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved checks in its September 14 broad software update. As of the available data, there is no public proof-of-concept, no CVSS score, and no evidence of in-the-wild exploitation.

What to do: Update affected Macs immediately: macOS Sequoia to 15.8, macOS Tahoe to 26.6 or 26.7, or macOS Golden Gate to 27 via System Settings > Software Update. On managed fleets, verify patch compliance and confirm Gatekeeper is enabled (e.g., `spctl --status` reports assessments enabled). Gatekeeper bypasses are commonly chained with browser exploits and sandbox escapes, so treat rapid patching as high priority and monitor Apple's security advisories for follow-on CVEs.