Skip to main content

macOS Gatekeeper EUVDEUVD-2026-78036

| CVE-2026-28899 MEDIUM
Protection Mechanism Failure (CWE-693)
2026-09-14 apple GHSA-8c8f-8rq7-f6jr
Authentication Bypass Apple macOS
5.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today AI
5.5 MEDIUM

Local malicious-app delivery (AV:L) opened by the user (UI:R), no prior privileges (PR:N); defeating Gatekeeper compromises code integrity (I:H) with no direct confidentiality or availability loss.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 23:40 vuln.today
tag: macOS added
Analysis Generated
Sep 16, 2026 - 22:50 vuln.today
CVSS changed
Sep 16, 2026 - 20:23 NVD
5.5 (MEDIUM)
Patch available
Sep 14, 2026 - 22:19 EUVD
CVE Published
Sep 14, 2026 - 20:49 cve.org
MEDIUM 5.5
CVE Published
Sep 14, 2026 - 20:49 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7. An app may bypass Gatekeeper checks.

AnalysisAI

Gatekeeper enforcement in Apple macOS can be bypassed by a malicious application that is delivered locally and opened by the user, letting the app run without satisfying macOS's normal code-signing and notarization checks. The flaw is a logic error (CWE-693, protection mechanism failure) affecting macOS builds prior to Golden Gate 27, Sequoia 15.8, Tahoe 26.6 and Tahoe 26.7; CVSS 5.5 reflects an integrity-only, non-privileged local impact that requires user interaction and grants no direct privilege escalation or confidentiality loss. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires local delivery and execution of a malicious application: the attacker must get their app onto the victim's Mac and the victim must open it (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals converge on MODERATE risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: update to macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6 or macOS Tahoe 26.7 as applicable - Apple advisories https://support.apple.com/en-us/128067, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042 and https://support.apple.com/en-us/149043 list the fixed builds, and patched systems are not affected. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in macOS

View all
CVE-2025-34089 CRITICAL POC
9.3 Jul 03

An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
CVE-2026-20700 HIGH POC
7.8 Feb 11

Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2022-48618 HIGH
7.0 Jan 09

The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)

CVE-2024-27822 HIGH POC
7.8 May 14

A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
CVE-2023-22809 HIGH POC
7.8 Jan 18

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
CVE-2022-46689 HIGH POC
7.0 Dec 15

A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
CVE-2022-32845 CRITICAL POC
10.0 Sep 23

This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2021-44790 CRITICAL POC
9.8 Dec 20

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-78036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy