CVE-2026-84570

Executive Summary

CVE-2026-84570 is a logic flaw in Apple's macOS Gatekeeper subsystem that allows an application to bypass Gatekeeper's security checks. Gatekeeper is the primary defense mechanism that validates code signatures and notarization status before allowing applications to execute on macOS. Affected systems include macOS Sequoia versions prior to 15.8, macOS Tahoe versions prior to 26.7, and macOS Golden Gate versions prior to 27.

The vulnerability is rated as a local attack vector requiring no privileges (PR:N) but user interaction (UI:R) is necessary to launch the malicious application. Successful exploitation undermines the core trust model of macOS application distribution, permitting unsigned or unnotarized code to execute. The absence of public exploit code and the low EPSS score (0.00207, 11.1th percentile) suggest the vulnerability is not currently exploited in the wild, though it represents a meaningful risk for targeted attacks against macOS endpoints.

Technical Analysis

The NVD description states: "A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Gatekeeper checks."

This is the entirety of the available technical detail. Based on the vulnerability classification (CWE-693: Protection Mechanism Failure) and the affected component (Gatekeeper), the flaw involves an inadequate validation sequence within macOS's application launch authorization flow. Gatekeeper normally evaluates applications against Apple's code signing and notarization requirements before permitting execution. A logic error — as opposed to a memory corruption or injection flaw — means that the checks themselves are structurally flawed, likely due to an incorrect state evaluation or an improper handling of specific application metadata or bundle configurations.

The attack surface is local: an attacker must deliver an application to the target system and convince the user to open it. This aligns with the CVSS attack vector AV:L (Local) and UI:R (User Interaction). The vulnerability class is "protection mechanism failure" — specifically, Gatekeeper bypass. No specific function names, API endpoints, or code paths are mentioned in the available description, and we do not speculate beyond what is stated.

Notable that the fix is described as "improved checks," indicating Apple modified the validation logic rather than patching a memory safety issue. The affected macOS versions (Sequoia 15.8, Tahoe 26.7, Golden Gate 27) indicate the vulnerability affects multiple major release branches, suggesting the flaw was introduced in a shared codebase component present across these generations.

Exploitation Scenarios

Based strictly on the NVD description and vulnerability class, the exploitation chain is as follows. No public proof-of-concept exists; the attack chain is inferred from the vulnerability class.

1. Reconnaissance / Target Identification: An attacker identifies macOS endpoints running vulnerable versions (Sequoia < 15.8, Tahoe < 26.7, Golden Gate < 27). This is a local attack; the attacker must already have a delivery vector to the target user — phishing, trojanized application download, or physical/remote access to the system.

2. Triggering the Flaw: The attacker crafts a malicious application bundle designed to exploit the Gatekeeper logic flaw. Because the flaw is a "logic issue" in the checks, the malicious app is crafted specifically to cause the flawed validation path to return an "allow" result incorrectly. The exact conditions are not disclosed in available intelligence; exploitation requires that the application be opened by the user (UI:R).

3. Execution Method (vulnerability-class level): Gatekeeper bypass means that the operating system's normal verification of code signature and notarization status is subverted. The malicious application executes without Gatekeeper blocking it, despite not satisfying Apple's required trust criteria. No specific payload delivery mechanism beyond "an app" is described.

4. Post-Exploitation Impact: Successful bypass permits unverified code execution with the privileges of the launching user. Depending on the malicious application's content, this could facilitate malware installation, persistence establishment, or further exploitation. The NVD description does not detail post-exploitation behaviors or privilege escalation beyond bypassing Gatekeeper.

Impact Assessment

The primary impact is a failure of the protection mechanism (CWE-693), resulting in an application executing despite failing Gatekeeper validation. Using the CVSSv3.1 base vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N:

• Confidentiality: High — Malicious code runs with the user's context, potentially accessing user data, credentials, and other local information.
• Integrity: High — The attacker can modify data accessible to the user.
• Availability: None — The vulnerability does not directly cause denial of service.
• Scope: Unchanged — The vulnerable component (Gatekeeper) and impacted component (user session) are within the same security authority.
• Attack Vector: Local — The attacker requires local access or delivery of an application to the target.
• User Interaction: Required — The user must open the malicious application.

The blast radius is limited to each individually targeted endpoint; this is not a wormable or network-autonomous exploit. Business impact includes compromise of macOS workstation integrity, potential for malware installation, and erosion of the trusted application execution model. The lack of public exploit code and low EPSS reduces immediate risk, but the vulnerability is attractive for targeted, user-assisted attacks against high-value macOS users.

Detection Guidance

Sigma Rule

title: Potential Gatekeeper Bypass via Unsigned Application Execution
id: 6b8f3c2a-9d4e-4f1b-8a7c-3e5d9f0a1b2c
status: experimental
description: Detects execution of applications that bypass Gatekeeper checks on macOS (CVE-2026-84570)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84570
author: Valters IT Threat Intelligence
date: 2026-06-15
tags:
  - attack.defense_evasion
  - attack.t1553.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: '.app/Contents/MacOS/'
  filter_legit:
    - ParentImage|startswith: '/System/'
    - ParentImage|startswith: '/usr/'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate unsigned internal applications
level: medium

YARA Rule

rule CVE_2026_84570_Gatekeeper_Bypass_Artifacts
{
    meta:
        description = "Detects artifacts associated with Gatekeeper bypass attempts (CVE-2026-84570)"
        author = "Valters IT Threat Intelligence"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84570"
        severity = "medium"

    strings:
        $gk1 = "com.apple.quarantine" ascii
        $gk2 = "com.apple.security.quarantine" ascii
        $gk3 = "Gatekeeper" ascii nocase
        $mach1 = "LC_CODE_SIGNATURE" ascii

    condition:
        uint32(0) == 0xfeedface or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe
        and 2 of ($gk*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-84570 Potential macOS Gatekeeper Bypass Application Download"; flow:established,to_server; http.method; content:"GET"; http.header; content:"User-Agent"; content:"Mac OS X"; http.uri; content:".app.zip"; nocase; classtype:attempted-user; sid:2026845701; rev:1; metadata:created_at 2026_06_15, cve CVE-2026-84570;)

Elastic Detection

process where event.type == "start" and process.name != null and
process.executable : "*.app/Contents/MacOS/*" and
not process.parent.executable : ("/System/*", "/usr/*", "/sbin/*") and
process.code_signature.status in ("unsigned", "invalid", "unknown")

Splunk SPL Query

index=macos sourcetype=osquery:results OR sourcetype=process_events
(process_path="*.app/Contents/MacOS/*" AND NOT parent_path IN ("/System/*","/usr/*"))
| stats count by host, process_name, process_path, parent_path, user
| where count > 0
| table host, user, process_name, process_path, parent_path, count

Wazuh OSSEC Rule

<group name="macos,gatekeeper,cve-2026-84570,">
  <rule id="100845" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.executable">\.app/Contents/MacOS/</field>
    <field name="process.code_signature.status">unsigned|invalid|unknown</field>
    <description>CVE-2026-84570: Potential Gatekeeper bypass - unsigned app execution</description>
    <mitre>
      <id>T1553.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations:

• Restrict users from executing unsigned or unnotarized applications via MDM configuration profiles enforcing Gatekeeper policy.
• Maintain application allowlisting using Apple's Endpoint Security framework or third-party tooling.
• Educate users against opening untrusted application bundles received via email, messaging, or web downloads.
• Enable macOS system integrity protections and monitor for quarantine attribute removal.

2. Patch / Upgrade Steps:

• Upgrade to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, which contain the fix described as "improved checks" for the Gatekeeper logic issue.
• Verify patch status through Apple's security content documentation; the single-source (NVD) claim should be validated against Apple's official advisory before considering deployment complete.

3. Long-Term Hardening:

• Enforce notarization and code-signing requirements organization-wide via MDM.
• Deploy EDR with Gatekeeper bypass detection coverage mapped to T1553.001.
• Regularly audit application execution and quarantine events across fleet.
• Monitor Apple security releases for follow-up advisories confirming the fix details.

References

1. NVD — CVE-2026-84570: https://nvd.nist.gov/vuln/detail/CVE-2026-84570
2. Apple Security Releases: https://support.apple.com/en-us/HT201222
3. MITRE ATT&CK T1553.001 — Gatekeeper Bypass: https://attack.mitre.org/techniques/T1553/001/
4. CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
5. FIRST EPSS — CVE-2026-84570 score data: https://api.first.org/data/v1/epss?cve=CVE-2026-84570

No threat actor campaigns or exploit-in-the-wild evidence are known at this time. CVE is not listed in CISA KEV. EPSS 0.00207 indicates extremely low predicted exploitation likelihood in the next 30 days. No public PoC or Nuclei template is available as of this report.