CVE-2026-28914: A maliciously crafted ZIP archive may bypass Gatekeeper checks in Apple macOS
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
AI Analysis
Technical Summary
CVE-2026-28914 is a vulnerability in Apple macOS where a logic flaw in file handling allowed specially crafted ZIP archives to bypass Gatekeeper checks. Gatekeeper is a macOS security feature designed to ensure that only trusted software runs on the system. The flaw was fixed by Apple in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.5 through improved file handling. The CVSS vector indicates the attack requires local access with low complexity and user interaction, and it impacts integrity without affecting confidentiality or availability.
Potential Impact
An attacker with local access and the ability to convince a user to interact with a malicious ZIP archive could bypass Gatekeeper protections, potentially leading to the execution of untrusted or malicious code. This compromises system integrity but does not affect confidentiality or availability. There are no known exploits in the wild currently.
Mitigation Recommendations
Apple has fixed this vulnerability in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5. Users and administrators should apply these official updates to ensure protection against this issue. No other mitigation or workaround is specified.
CVE-2026-28914: A maliciously crafted ZIP archive may bypass Gatekeeper checks in Apple macOS
Description
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-28914 is a vulnerability in Apple macOS where a logic flaw in file handling allowed specially crafted ZIP archives to bypass Gatekeeper checks. Gatekeeper is a macOS security feature designed to ensure that only trusted software runs on the system. The flaw was fixed by Apple in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.5 through improved file handling. The CVSS vector indicates the attack requires local access with low complexity and user interaction, and it impacts integrity without affecting confidentiality or availability.
Potential Impact
An attacker with local access and the ability to convince a user to interact with a malicious ZIP archive could bypass Gatekeeper protections, potentially leading to the execution of untrusted or malicious code. This compromises system integrity but does not affect confidentiality or availability. There are no known exploits in the wild currently.
Mitigation Recommendations
Apple has fixed this vulnerability in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5. Users and administrators should apply these official updates to ensure protection against this issue. No other mitigation or workaround is specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apple
- Date Reserved
- 2026-03-03T16:36:03.985Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a028752cbff5d86108b583f
Added to database: 05/12/2026, 01:50:10 UTC
Last enriched: 07/30/2026, 00:52:35 UTC
Last updated: 07/31/2026, 21:26:47 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.