{"id":"CVE-2026-86941","kind":"vulnerability","aliases":["CVE-2026-86941"],"related":[],"title":"macOS: quarantine bypass lets an app skip Gatekeeper checks","description":"A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks.","summary":"A file quarantine bypass in macOS lets an app skip Gatekeeper checks on files it handles. The sources do not say what the attacker gains beyond that bypass.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["fixed-macos-build"],"how_to_check":"- Check the installed macOS version with `sw_vers`\n- Compare it against the fixed builds: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2\n- unknown for any other check, the sources do not say","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching the installed major release\n- unknown for any other action, the sources do not say","status":"open","published_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:52+00:00","updated_at":"2026-10-26T21:56:52+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:56:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching the installed major release\n- unknown for any other action, the sources do not say","reach":"local","title":"macOS: quarantine bypass lets an app skip Gatekeeper checks","impact":"medium","summary":"A file quarantine bypass in macOS lets an app skip Gatekeeper checks on files it handles. The sources do not say what the attacker gains beyond that bypass.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Malicious app bypasses Gatekeeper checks on the Mac","analyst_note":"Find Apple's security notice for CVE-2026-86941 to confirm the attack conditions, the user interaction needed and the impact beyond the Gatekeeper bypass.","how_to_check":"- Check the installed macOS version with `sw_vers`\n- Compare it against the fixed builds: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["fixed-macos-build"],"who_is_affected":"Mac fleets on the affected macOS releases are exposed, since the bypass sits in the system's quarantine and Gatekeeper handling. The sources do not say which app conditions or user actions are needed to trigger it. Machines already on the fixed builds can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3277,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-86941':12A,15A '15.8.2':67C '26.7.2':70C '27.2':64C 'addit':54C 'address':52C 'app':6A,27B,72C 'attack':42B 'beyond':44B 'bypass':3A,22B,46B,50C,74C 'check':9A,30B,55C,76C 'cve':10A,13A 'endpoint':16B 'file':20B,32B,48C 'fix':59C 'gain':43B 'gate':63C 'gatekeep':8A,29B,75C 'golden':62C 'handl':34B 'infrastructur':17B 'issu':57C 'let':4A,25B 'maco':1A,18B,24B,61C,65C,68C 'may':73C 'quarantin':2A,21B,49C 'say':39B 'sequoia':66C 'skip':7A,28B 'sourc':36B 'taho':69C","nicknames":[],"mitigations":[],"who_affected":"Mac fleets on the affected macOS releases are exposed, since the bypass sits in the system's quarantine and Gatekeeper handling. The sources do not say which app conditions or user actions are needed to trigger it. Machines already on the fixed builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86941","severity":null,"published_at":"2026-10-26T21:20:31+00:00","modified_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}