{"id":"CVE-2026-86937","kind":"vulnerability","aliases":["CVE-2026-86937"],"related":[],"title":"Apple macOS: logic flaw lets an app bypass Gatekeeper checks","description":"A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks.","summary":"A logic flaw in macOS state management lets a malicious app bypass Gatekeeper's launch checks. An attacker who gets a crafted app onto a Mac can run it without the usual malware warnings.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions below.\n- unknown for other checks; the sources do not say.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe).","status":"open","published_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:53+00:00","updated_at":"2026-10-26T21:56:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:56:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe).","reach":"local","title":"Apple macOS: logic flaw lets an app bypass Gatekeeper checks","impact":"medium","summary":"A logic flaw in macOS state management lets a malicious app bypass Gatekeeper's launch checks. An attacker who gets a crafted app onto a Mac can run it without the usual malware warnings.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"no","worst_case":"Malicious app runs on Mac without Gatekeeper warnings.","analyst_note":"Check Apple's security notes for the CVE-2026-86937 entry to confirm attack prerequisites and user interaction required.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions below.\n- unknown for other checks; the sources do not say.","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Any Mac running an unpatched macOS release is potentially affected, since the flaw sits in the operating system's Gatekeeper handling. The sources do not say whether specific configurations or user actions are required, so treat all unpatched Macs as in scope. Teams running only patched releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000593,"input_tokens":3269,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86937':13A,16A '15.8.2':75C '26.7.2':78C '27.2':72C 'address':59C 'app':7A,31B,43B,80C 'appl':1A,17B 'attack':38B 'bypass':8A,32B,82C 'check':10A,36B,84C 'craft':42B 'cve':11A,14A 'endpoint':18B 'fix':67C 'flaw':4A,23B 'gate':71C 'gatekeep':9A,33B,83C 'get':40B 'golden':70C 'improv':61C 'infrastructur':19B 'issu':57C,65C 'launch':35B 'let':5A,28B 'logic':3A,22B,56C 'mac':46B 'maco':2A,20B,25B,69C,73C,76C 'malici':30B 'malwar':53B 'manag':27B,63C 'may':81C 'onto':44B 'run':48B 'sequoia':74C 'state':26B,62C 'taho':77C 'usual':52B 'warn':54B 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Any Mac running an unpatched macOS release is potentially affected, since the flaw sits in the operating system's Gatekeeper handling. The sources do not say whether specific configurations or user actions are required, so treat all unpatched Macs as in scope. Teams running only patched releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86937","severity":null,"published_at":"2026-10-26T21:20:31+00:00","modified_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}