What is the CVSS score of CVE-2026-28849?

CVE-2026-28849 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-28849?

Yes, a patch is available for CVE-2026-28849. Update the affected software to the latest version immediately.

macOS CVE-2026-28849

EUVD-2026-49436 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-27 apple

GHSA-r4rg-rrj9-352x

Authentication Bypass Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

Local vector due to file opening; user interaction mandatory; high integrity impact from bypassing Gatekeeper.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:35 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

AnalysisAI

A Gatekeeper bypass in macOS allows maliciously crafted ZIP archives to evade security checks, enabling installation of untrusted applications. Affected are macOS Sonoma 14.x prior to 14.8.8 and Sequoia 15.x prior to 15.7.8; exploitation requires user interaction. No active exploitation or public exploit code is known, and a vendor patch is available.

Technical ContextAI

Gatekeeper is Apple's application-layer security mechanism that verifies code signatures and notarization for downloaded files. This vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), stems from insufficient validation of ZIP archives, allowing a malicious archive to appear as trusted and bypass the usual security prompt. The affected component is the archive handling within macOS, as indicated by the local attack vector and user interaction requirement.

RemediationAI

Upgrade to macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8, as detailed in Apple's security updates. As a general precaution, avoid opening ZIP archives from untrusted sources and ensure Gatekeeper is enabled (default in macOS). No workarounds are provided by Apple; patching is the primary remediation.