PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-46310 Apple CVE debrief

A state management vulnerability in macOS allows attackers with root privileges to delete protected system files. Apple addressed this through improved state management in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) indicates a local attack vector requiring high privileges, with high impact to integrity and availability but no confidentiality impact. The weakness is categorized as CWE-269 (Improper Privilege Management). This vulnerability was published on February 11, 2026 and last modified on May 26, 2026. It is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Apple
Product
macOS
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-11
Original CVE updated
2026-05-26
Advisory published
2026-02-11
Advisory updated
2026-05-26

Who should care

System administrators managing macOS fleets, security teams monitoring for insider threats or post-exploitation activity, and organizations with compliance requirements for system integrity controls.

Technical summary

This vulnerability stems from improper state management in macOS that allows root-privileged processes to bypass protections on system files. The attack requires local access and root privileges, making it primarily a concern for post-exploitation scenarios or insider threats. Successful exploitation results in deletion of protected system files, which could lead to system instability or denial of service. The fix implements improved state management to properly enforce file protection boundaries even for root processes.

Defensive priority

medium

Recommended defensive actions

  • Apply the security updates for macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, or macOS Tahoe 26 as appropriate for your system version.
  • Review systems for unauthorized deletion of protected system files if patching is delayed.
  • Ensure least-privilege access controls are enforced to limit the number of accounts with root privileges.
  • Monitor for anomalous file system operations on protected system directories.

Evidence notes

The vulnerability affects macOS versions 14.0 through 14.8.4 (exclusive) and 15.0 through 15.7.4 (exclusive). The CVSS score of 6.0 (MEDIUM) reflects the requirement for root privileges, which limits the attack surface to scenarios where an attacker has already achieved privileged access. The CWE-269 classification indicates improper privilege management in the state handling mechanism.

Official resources

Apple addressed this vulnerability through improved state management. The fix is available in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.