CVE-2026-28849
Undergoing Analysis Undergoing Analysis - In Progress

Gatekeeper Bypass via Malicious ZIP Archive in macOS

Publication date: 2026-07-27

Last updated on: 2026-07-29

Assigner: Apple Inc.

Description
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-29
Generated
2026-08-17
AI Q&A
2026-07-28
EPSS Evaluated
2026-08-15
NVD
CVE-2026-28849
EUVD
EUVD-2026-49436

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apple macos From 14.0 (inc) to 14.8.8 (exc)
apple macos From 15.0 (inc) to 15.7.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a maliciously crafted ZIP archive that can bypass Gatekeeper checks on macOS systems. Gatekeeper is a security feature designed to ensure only trusted software runs on the system. The issue was addressed in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.

Detection Guidance

This vulnerability involves a maliciously crafted ZIP archive bypassing Gatekeeper checks in macOS Sequoia and Sonoma. Detection requires verifying macOS version and scanning for suspicious ZIP files. Check your macOS version with 'sw_vers' and inspect ZIP archives for unexpected contents or unusual metadata.

Impact Analysis

This vulnerability could allow an attacker to bypass security checks and run untrusted or malicious software on your macOS device. This might lead to unauthorized access, data theft, or installation of malware without your knowledge.

Compliance Impact

The vulnerability involves a maliciously crafted ZIP archive bypassing Gatekeeper checks in macOS Sequoia and Sonoma. This could potentially allow unauthorized access or execution of malicious code, which may impact data integrity and security. However, the provided CVE details do not specify direct compliance implications for standards like GDPR or HIPAA.

Mitigation Strategies

Update to macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8 or later to address the issue with maliciously crafted ZIP archives bypassing Gatekeeper checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart