CVE-2026-28849

Received Received - Intake

Gatekeeper Bypass via Malicious ZIP Archive in macOS

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Apple Inc.

Description

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-28849

EUVD

EUVD-2026-49436

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos_sequoia	15.7.8
apple	macos_sonoma	14.8.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a maliciously crafted ZIP archive that can bypass Gatekeeper checks on macOS systems. Gatekeeper is a security feature designed to ensure only trusted software runs on the system. The issue was addressed in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.

Impact Analysis

This vulnerability could allow an attacker to bypass security checks and run untrusted or malicious software on your macOS device. This might lead to unauthorized access, data theft, or installation of malware without your knowledge.

Mitigation Strategies

Update to macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8 or later to address the issue with maliciously crafted ZIP archives bypassing Gatekeeper checks.

Hi! I’m here to help you understand CVE-2026-28849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70