{"id":"CVE-2026-64789","kind":"vulnerability","aliases":["CVE-2026-64789"],"related":[],"title":"macOS: improved file attribute validation stops apps bypassing Gatekeeper checks","description":"This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may bypass Gatekeeper checks.","summary":"Apple fixed a flaw in macOS file attribute validation that let a malicious application bypass Gatekeeper checks. Gatekeeper is the macOS control that vets downloaded and unsigned software before it runs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","endpoints","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions below.\n- unknown","fix":"- Update macOS to `27` (macOS Golden Gate), `15.8.2` (macOS Sequoia) or `26.7.2` (macOS Tahoe) or later.","status":"open","published_at":"2026-10-26T21:18:36+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","triaged_at":"2026-10-26T21:21:30+00:00","updated_at":"2026-10-26T21:21:30+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:21:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27` (macOS Golden Gate), `15.8.2` (macOS Sequoia) or `26.7.2` (macOS Tahoe) or later.","reach":"local","title":"macOS: improved file attribute validation stops apps bypassing Gatekeeper checks","impact":"medium","summary":"Apple fixed a flaw in macOS file attribute validation that let a malicious application bypass Gatekeeper checks. Gatekeeper is the macOS control that vets downloaded and unsigned software before it runs.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints","developers"],"confidence":0.6,"needs_auth":"no","worst_case":"malicious app runs despite Gatekeeper blocking it","analyst_note":"Sources do not give the exact Apple security notes, CVSS, or whether exploitation requires user interaction; check Apple's security releases page for CVE-2026-64789.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions below.\n- unknown","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Macs running macOS versions earlier than the fixed releases are affected, since the flaw sits in the operating system's Gatekeeper validation. Systems already on the fixed releases, or managed fleets that have applied the update, can skip it. The sources do not say whether a user must first open or run a malicious app.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3276,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-64789':13A,16A '15.8.2':73C '26.7.2':76C '27':70C 'address':55C 'app':7A 'appl':21B 'applic':34B,79C 'attribut':4A,28B,61C 'bypass':8A,35B,81C 'check':10A,37B,83C 'control':42B 'cve':11A,14A 'develop':17B 'download':45B 'endpoint':18B 'file':3A,27B,60C 'fix':22B,65C 'flaw':24B 'gate':69C 'gatekeep':9A,36B,38B,82C 'golden':68C 'improv':2A,57C 'infrastructur':19B 'issu':53C,63C 'let':31B 'maco':1A,20B,26B,41B,67C,71C,74C 'malici':33B,78C 'may':80C 'run':51B 'sequoia':72C 'softwar':48B 'stop':6A 'taho':75C 'unsign':47B 'valid':5A,29B,58C 'vet':44B","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS versions earlier than the fixed releases are affected, since the flaw sits in the operating system's Gatekeeper validation. Systems already on the fixed releases, or managed fleets that have applied the update, can skip it. The sources do not say whether a user must first open or run a malicious app.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64789","severity":null,"published_at":"2026-10-26T21:18:36+00:00","modified_at":"2026-10-26T21:18:36+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}