Apple macOS CVE-2026-65399

Requires the attacker to deliver a specially crafted archive to the victim and for the victim to expand/open it on an affected Apple OS; the flaw lets that archive evade the Gatekeeper/file-quarantine (com.apple.quarantine) verification so enclosed unsigned or un-notarized code executes without the normal block or warning prompt. LIMITING FACTORS: local vector (AV:L) - the archive must reach and be processed on the device; realistically depends on user action to expand the archive (contradicting the vendor's UI:N); impact is bounded (C:L/I:L/A:N) because it bypasses a trust warning rather than directly executing arbitrary code with high privilege. Affected versions: macOS <15.8/<26.7/<27, iOS/iPadOS <26.7/<27, visionOS/watchOS <27.

This is a genuinely low-priority issue despite the security-relevant nature of a Gatekeeper bypass. All exploitation signals point away from urgency: EPSS is 0.18% (8th percentile), it is NOT in CISA KEV, and no public exploit code has been identified. The vendor CVSS is only 4.4 (Medium-low) with a LOCAL attack vector (AV:L), low impacts (C:L/I:L/A:N), and no scope change (S:U). The key nuance is that this is a trust-gate/protection-mechanism bypass, not a memory-corruption or direct code-execution primitive - the archive merely evades the com.apple.quarantine/Gatekeeper verification so that enclosed content runs without the normal block or warning. That makes it a useful LINK in a social-engineering chain rather than a standalone threat. NOTE A DISCREPANCY: the vendor vector lists UI:N (no user interaction), but the description ('an archive may be able to bypass Gatekeeper') strongly implies the victim must download and expand the attacker-supplied archive, which is UI:R - verify with vendor. Also, Gatekeeper is fundamentally a macOS mechanism, yet the CVE is cross-listed to iOS/iPadOS/visionOS/watchOS (as file-quarantine); treat the non-macOS entries as the broader quarantine subsystem rather than classic desktop Gatekeeper.

An attacker packages a malicious application inside a crafted archive and delivers it via phishing, a download link, or a messaging attachment. When the victim expands the archive on an affected Apple device, the enclosed payload evades the Gatekeeper/quarantine signature-and-notarization check and can run without the usual security prompt or block. No public exploit code is currently identified, and the low CVSS impacts (C:L/I:L) reflect that this bypasses a warning rather than directly granting code execution or data theft on its own.