{"id":"CVE-2026-84610","kind":"vulnerability","aliases":["CVE-2026-84610"],"related":[],"title":"macOS: crafted ZIP archive can bypass Gatekeeper quarantine checks","description":"A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A maliciously crafted ZIP archive may bypass Gatekeeper checks.","summary":"A maliciously crafted ZIP archive can bypass the file quarantine checks that Gatekeeper applies to downloaded files. An attacker who gets a user to open such an archive can run software that macOS would otherwise block or warn about.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions: `27`, `15.8.2`, `26.7.2`\n- unknown","fix":"- Update macOS to `27`, `15.8.2` or `26.7.2`, or later on the same release line\n- unknown","status":"open","published_at":"2026-10-26T21:20:16+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:08+00:00","updated_at":"2026-10-26T21:57:08+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:57:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27`, `15.8.2` or `26.7.2`, or later on the same release line\n- unknown","reach":"unknown","title":"macOS: crafted ZIP archive can bypass Gatekeeper quarantine checks","impact":"medium","summary":"A maliciously crafted ZIP archive can bypass the file quarantine checks that Gatekeeper applies to downloaded files. An attacker who gets a user to open such an archive can run software that macOS would otherwise block or warn about.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"no","worst_case":"Unsigned or blocked software from a downloaded archive runs on the Mac","analyst_note":"Check the Apple security notes for CVE-2026-84610 for affected builds, exploitation details and whether user interaction is required.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions: `27`, `15.8.2`, `26.7.2`\n- unknown","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running an unpatched macOS release on the affected lines can be exposed, since the flaw is in how the system checks archives it receives. The sources do not say whether a specific download path or configuration is required, so unknown for finer scoping. Teams that manage Macs should prioritise machines that handle untrusted archives.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3287,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-84610':12A,15A '15.8.2':77C '26.7.2':80C '27':74C 'addit':64C 'address':62C 'appli':32B 'archiv':4A,23B,46B,85C 'attack':37B 'block':54B 'bypass':6A,25B,60C,87C 'check':9A,29B,65C,89C 'craft':2A,21B,83C 'cve':10A,13A 'download':34B 'endpoint':16B 'file':27B,35B,58C 'fix':69C 'gate':73C 'gatekeep':7A,31B,88C 'get':39B 'golden':72C 'infrastructur':17B 'issu':67C 'maco':1A,18B,51B,71C,75C,78C 'malici':20B,82C 'may':86C 'open':43B 'otherwis':53B 'quarantin':8A,28B,59C 'run':48B 'sequoia':76C 'softwar':49B 'taho':79C 'user':41B 'warn':56B 'would':52B 'zip':3A,22B,84C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running an unpatched macOS release on the affected lines can be exposed, since the flaw is in how the system checks archives it receives. The sources do not say whether a specific download path or configuration is required, so unknown for finer scoping. Teams that manage Macs should prioritise machines that handle untrusted archives.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84610","severity":null,"published_at":"2026-10-26T21:20:16+00:00","modified_at":"2026-10-26T21:20:16+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}