CVE-2026-28854

Analyzed Analyzed - Analysis Complete

macOS Golden Gate App Bundle Integrity Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Apple Inc.

Description

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-28854

EUVD

EUVD-2026-104698

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-353	The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in macOS Golden Gate 27 where additional app bundle integrity checks were insufficient. A maliciously modified app could bypass these checks and launch, potentially allowing unauthorized or harmful software to run on the system.

Detection Guidance

This vulnerability involves app bundle integrity checks in macOS Golden Gate 27. Detection may require verifying app signatures and bundle integrity using macOS built-in tools like codesign or checking system logs for unauthorized app launches. No specific commands are provided in the given context.

Impact Analysis

This vulnerability could allow attackers to run malicious apps on your device, leading to unauthorized access, data theft, or further compromise of your system. It undermines the security model designed to prevent untrusted apps from executing.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a maliciously modified app bypassing integrity checks in macOS Golden Gate 27, which could potentially allow unauthorized access or execution of malicious software.

Mitigation Strategies

Update to macOS Golden Gate 27 or later to apply the additional app bundle integrity checks that address this issue.

Hi! I’m here to help you understand CVE-2026-28854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...