CVE-2021-30657: Apple macOS Gatekeeper bypass via state management logic flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed Gatekeeper bypass with confirmed active exploitation reports and a very high EPSS score, though it requires local user interaction and has only medium CVSS severity.

What it is

A logic issue in macOS state management lets a malicious application bypass Gatekeeper checks, which normally block untrusted software from running. Apple fixed it in macOS Big Sur 11.3 and Security Update 2021-002 Catalina, and stated it was aware of a report that the issue may have been actively exploited. Because Gatekeeper is a core macOS defense against untrusted code, a bypass undermines the platform's first line of defense against malware.

Impact

An attacker can run a malicious application that Gatekeeper would otherwise block, gaining code execution on the target Mac without the usual trust prompt. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

The vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker must get a malicious application onto the system and persuade the user to open or run it. No authentication is needed beyond the user's action.

Exploitation

The record is in CISA's KEV catalog (added 2021-11-03), and Apple stated it was aware of a report of active exploitation. EPSS is 0.68531 (99.3rd percentile), indicating high predicted exploitation likelihood.

What to do

• Update to macOS Big Sur 11.3 or later, or apply Security Update 2021-002 Catalina, per Apple's advisories.
• Enforce a minimum OS version baseline so unpatched Macs cannot run untrusted applications.
• Restrict users from running unsigned or unnotarized applications and enforce application allowlisting where feasible.
• Monitor for and remove malicious applications that attempt to bypass Gatekeeper, and review Gatekeeper and XProtect logs.
• Verify patch status across the fleet and treat any Mac below the fixed versions as exposed.

Detection

• Review Gatekeeper (syspolicy) and XProtect logs for blocked or bypassed application launches.
• Hunt for applications executing outside expected notarization or signing requirements.
• Correlate endpoint telemetry for processes launched from quarantine-flagged or downloaded locations.
• Check macOS version inventory for hosts below Big Sur 11.3 or without Security Update 2021-002 Catalina.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.