{"id":"CVE-2026-28854","kind":"vulnerability","aliases":["CVE-2026-28854"],"related":[],"title":"Apple macOS: app bundle integrity checks missing, modified apps may launch","description":"The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.","summary":"A maliciously modified macOS app may not be blocked from launching, because the system lacked full app bundle integrity checks. Apple fixed it with additional checks in macOS Golden Gate 27.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["macos-golden-gate-27-or-later"],"how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare against the fixed release named by Apple\n- unknown for further checks: the sources do not describe a specific file or setting","fix":"- Update macOS to Golden Gate 27 or later via Software Update\n- unknown for an earlier interim build number: the sources do not name one","status":"open","published_at":"2026-10-20T01:17:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T05:06:14+00:00","updated_at":"2026-10-25T05:06:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:06:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27 or later via Software Update\n- unknown for an earlier interim build number: the sources do not name one","reach":"local","title":"Apple macOS: app bundle integrity checks missing, modified apps may launch","impact":"medium","summary":"A maliciously modified macOS app may not be blocked from launching, because the system lacked full app bundle integrity checks. Apple fixed it with additional checks in macOS Golden Gate 27.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A tampered app launches on the Mac despite the integrity failure.","analyst_note":"Check Apple's security notes for CVE-2026-28854 for affected versions, the exact fixed build, and whether user interaction is needed.","how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare against the fixed release named by Apple\n- unknown for further checks: the sources do not describe a specific file or setting","needs_analyst":true,"not_affected_if":["macos-golden-gate-27-or-later"],"who_is_affected":"Mac users and fleets running macOS releases before Golden Gate 27 are exposed to a tampered app launching. The sources do not say which apps or configurations are needed for the flaw to be reached, so the exposure scope is unknown. Teams on fully patched macOS Golden Gate 27 or later can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000601,"input_tokens":3249,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-28854':14A,17A '27':52B,71C 'addit':46B,58C 'address':56C 'app':3A,9A,26B,38B,59C,75C 'appl':1A,18B,42B 'block':30B 'bundl':4A,39B,60C 'check':6A,41B,47B,62C 'cve':12A,15A 'endpoint':19B 'fix':43B,66C 'full':37B 'gate':51B,70C 'golden':50B,69C 'infrastructur':20B 'integr':5A,40B,61C 'issu':54C,64C 'lack':36B 'launch':11A,32B,81C 'maco':2A,21B,25B,49B,68C 'malici':23B,73C 'may':10A,27B,76C 'miss':7A 'modifi':8A,24B,74C 'prevent':79C 'system':35B","nicknames":[],"mitigations":[],"who_affected":"Mac users and fleets running macOS releases before Golden Gate 27 are exposed to a tampered app launching. The sources do not say which apps or configurations are needed for the flaw to be reached, so the exposure scope is unknown. Teams on fully patched macOS Golden Gate 27 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28854","severity":null,"published_at":"2026-10-20T01:17:11+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}