PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-46310 Apple CVE debrief

A state management vulnerability in macOS allows attackers with root privileges to delete protected system files. Apple addressed this through improved state management in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) indicates a local attack vector requiring high privileges, with high impact to integrity and availability but no confidentiality impact. The weakness is categorized as CWE-269 (Improper Privilege Management). This vulnerability was published on February 11, 2026 and last modified on May 26, 2026. It is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Apple
Product
macOS
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-11
Original CVE updated
2026-05-26
Advisory published
2026-02-11
Advisory updated
2026-05-26

Who should care

System administrators managing macOS fleets, security teams monitoring for insider threats or post-exploitation activity, and organizations with compliance requirements for system integrity controls.

Technical summary

This vulnerability stems from improper state management in macOS that allows root-privileged processes to bypass protections on system files. The attack requires local access and root privileges, making it primarily a concern for post-exploitation scenarios or insider threats. Successful exploitation results in deletion of protected system files, which could lead to system instability or denial of service. The fix implements improved state management to properly enforce file protection boundaries even for root processes.

Defensive priority

medium

Recommended defensive actions

  • Apply the security updates for macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, or macOS Tahoe 26 as appropriate for your system version.
  • Review systems for unauthorized deletion of protected system files if patching is delayed.
  • Ensure least-privilege access controls are enforced to limit the number of accounts with root privileges.
  • Monitor for anomalous file system operations on protected system directories.

Evidence notes

The vulnerability affects macOS versions 14.0 through 14.8.4 (exclusive) and 15.0 through 15.7.4 (exclusive). The CVSS score of 6.0 (MEDIUM) reflects the requirement for root privileges, which limits the attack surface to scenarios where an attacker has already achieved privileged access. The CWE-269 classification indicates improper privilege management in the state handling mechanism.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-46310 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-46310

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-46310 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-46310

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.