Security readout for executives and security teams
Plain-English summary
A specially crafted ZIP file can bypass macOS Gatekeeper checks, weakening a protection intended to warn users about untrusted software. User interaction is required, and the supplied evidence does not establish active exploitation. Successful abuse could allow unauthorized modification, but this flaw alone is not described as providing remote access or data theft.
Executive priority
Treat this as a prompt patching priority, especially for user workstations handling external files. It is not supported as an emergency active-exploitation event, but Gatekeeper bypasses weaken a key macOS trust control. Track update coverage and exceptions until affected fleets reach an applicable fixed release.
Technical view
CVE-2026-28914 is a file-handling logic issue affecting Gatekeeper enforcement for malicious ZIP archives. Apple addressed it through improved file handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.5. CVSS 3.1 scores it 5.5: local access, low complexity, no privileges, user interaction, and high integrity impact.
Likely exposure
Exposure centers on Macs running releases earlier than the applicable fixed version whose users receive and open untrusted ZIP archives. The source bundle lists placeholder affected versions, so it does not establish the complete vulnerable-version range. Internet-facing systems are not inherently exposed because the CVSS vector requires local execution and user interaction.
Exploitation context
The supplied record is not in CISA KEV, and no cited source states that exploitation is active. Abuse requires a maliciously crafted ZIP archive and user interaction. Gatekeeper bypass reduces a security boundary, but the sources do not describe the subsequent payload, attack chain, prevalence, or observed victims.
Researcher notes
The record maps the flaw to CWE-358 and CWE-693. The CVSS vector indicates integrity impact without claimed confidentiality or availability impact. Public details are sparse: the exact vulnerable-version boundaries, archive-processing mechanics, resulting code-execution conditions, and exploitation observations are not provided. Avoid interpreting the Gatekeeper bypass alone as proof of arbitrary code execution.
Mitigation direction
- Update Macs to Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.5, or a later applicable vendor release.
- Prioritize endpoints whose users routinely receive ZIP archives from external or untrusted sources.
- Consult Apple guidance for unsupported Macs or systems where immediate updating is operationally blocked.
- Reinforce controls against opening unexpected archives while updates are being deployed.
Validation and detection
- Inventory macOS editions and versions against Apple's three listed fixed releases.
- Identify earlier releases, noting that the bundle does not define the complete affected-version range.
- Confirm managed endpoints successfully installed the applicable update and restarted if required by Apple.
- Review endpoint telemetry for suspicious activity associated with recently downloaded or externally received ZIP archives.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-358: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28914 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/127115CVE reference, apple
- https://support.apple.com/en-us/128071CVE reference, apple
- https://support.apple.com/en-us/128072CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improperly Implemented Security Check for Standard
Improperly Implemented Security Check for Standard represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Protection Mechanism Failure
Protection Mechanism Failure represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.