Apple macOS has a configuration issue that was mitigated with additional restrictions, but account‑driven User Enrollment can still occur when Lockdown Mode is enabled. Based on the description, it is inferred that an attacker could create new user accounts and, through those accounts, potentially install software or achieve elevated privileges that Lockdown Mode is designed to prevent. The weakness is a classic Access Control flaw (CWE‑284).

Apple macOS versions prior to Sequoia 15.6 and Sonoma 14.7.7. The issue was addressed in those releases, but earlier versions remain vulnerable. All affected macOS installations should be considered at risk if they run an older release.

The CVSS score of 9.8 marks this as critical, yet the EPSS score of less than 1% suggests very low current exploitation probability. Because it is not listed in CISA’s KEV catalog, there are no confirmed widespread attacks. Based on the description, it is inferred that the attack would be local, requiring improper configuration of Lockdown Mode and account‑enrollment settings, and could potentially be leveraged by a malicious user who gains initial access to the system.