The vulnerability allows an application to override macOS MDM‑enforced settings from profiles, enabling the modification or disabling of device‑management policies on an affected system. The flaw is an Improper Access Control defect (CWE‑284), and it permits an attacker to alter profile‑controlled configuration settings that are normally enforced by administrators.

Apple macOS systems prior to macOS Tahoe 26 are susceptible because the additional logic that blocks the override has not been applied. All earlier macOS releases that support MDM profiles are at risk until the device receives the Tahoe 26 update or later that contains the fix.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% signifies a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local application running on the device; an attacker must install or otherwise cause a malicious app to be executed in order to use the override capability.