Live › vulnerability › CVE-2026-86937
Go to dashboardA logic flaw in macOS state management lets a malicious app bypass Gatekeeper's launch checks. An attacker who gets a crafted app onto a Mac can run it without the usual malware warnings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:55 UTC. All times on this page are UTC.
Any Mac running an unpatched macOS release is potentially affected, since the flaw sits in the operating system's Gatekeeper handling. The sources do not say whether specific configurations or user actions are required, so treat all unpatched Macs as in scope. Teams running only patched releases can skip it.
No product ranges from the sources yet.
sw_vers -productVersion on each Mac and compare against the fixed versions below.27.2 (Golden Gate), 15.8.2 (Sequoia), or 26.7.2 (Tahoe).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-86937")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.