CVE-2026-28849 in macOS
Summary
by MITRE • 07/28/2026
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability represents a critical weakness in macOS security mechanisms that allows maliciously crafted zip archives to bypass Gatekeeper protections designed to prevent unauthorized software installation. The flaw stems from inadequate validation of archive contents during the Gatekeeper verification process, creating an avenue for attackers to circumvent system security controls through carefully constructed archive files. The issue affects multiple macOS versions including the latest releases of Sequoia and Sonoma, indicating a persistent problem that required significant security updates to address.
The technical implementation flaw occurs within the zip archive extraction and validation logic where the system fails to properly verify the integrity and authenticity of archived content before permitting execution. This weakness enables attackers to embed malicious payloads within seemingly legitimate zip files that would normally be rejected by Gatekeeper's security checks. The vulnerability operates at the intersection of archive handling and code signing verification, creating a pathway for privilege escalation and unauthorized code execution. According to CWE standards, this represents a weakness in validation of input from an upstream component where the system fails to properly validate archive contents against established security policies.
The operational impact of this vulnerability is severe as it allows attackers to bypass fundamental macOS security controls that protect users from malicious software installation. An attacker could craft a zip archive containing malware that would be silently accepted by the system, potentially leading to full system compromise without user awareness or explicit consent. This creates a significant risk for enterprise environments where users may inadvertently download and execute malicious files through email attachments or compromised websites. The vulnerability particularly affects systems running the affected macOS versions where proper input validation has not been implemented.
Security mitigations for this issue involve immediate deployment of the security updates provided by Apple, which include enhanced checks for zip archive contents during Gatekeeper verification. Organizations should implement additional monitoring for suspicious file downloads and ensure that all systems are updated to the latest supported macOS versions. The fix addresses the root cause through improved validation logic that properly examines archive structures and content before granting execution permissions. Network security controls such as sandboxing and application whitelisting can provide additional defense in depth while waiting for complete deployment of the patches.
The vulnerability demonstrates the importance of proper input validation in security-critical systems, particularly when handling user-supplied data like compressed archives. This weakness aligns with ATT&CK techniques related to privilege escalation and execution through malicious file downloads, emphasizing the need for comprehensive security controls at multiple layers. The fix represents a critical enhancement to macOS security architecture that addresses both immediate threats and prevents similar vulnerabilities in future implementations. Security professionals should monitor for additional related vulnerabilities in archive handling mechanisms across different operating systems and applications.
Additional recommendations include implementing automated vulnerability scanning for zip file content within enterprise environments, maintaining updated threat intelligence feeds for malicious archive signatures, and conducting regular security assessments of file processing components. The update addresses a fundamental security gap that could have enabled persistent threats to establish footholds within protected environments. This vulnerability underscores the importance of continuous security testing and validation of system defenses against sophisticated attack vectors that target core security mechanisms.