The vulnerability is an authorization flaw in macOS that allows an application with administrative privileges to modify the System Keychain. By bypassing entitlement checks, a privileged app can alter or remove credentials stored in the keychain, potentially compromising the integrity and confidentiality of system authentication data. This issue is rooted in missing or improper authorization checks (CWE-862).

Apple's macOS operating system is affected. Versions prior to macOS Sequoia 15.8 and macOS Tahoe 26.7 are vulnerable. The patch that addresses the issue is available in those releases and later versions.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to already run code with administrator privileges on a macOS machine; after gaining such privileges, the attacker can alter the System Keychain. Given the low exploitation probability and lack of publicly disclosed exploit code, the immediate risk is considered moderate pending update deployment.