What is the CVSS score of CVE-2025-43184?

CVE-2025-43184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of macOS are affected by CVE-2025-43184?

CVE-2025-43184 is a critical authentication bypass in macOS Shortcuts (versions 13.x-15.x pre-July 2025) that allows locally executed malicious shortcuts to access sensitive app settings without user…

How to fix or mitigate CVE-2025-43184?

Within 24 hours: Inventory macOS systems running Ventura 13.x, Sonoma 14.x, or Sequoia 15.x and identify any custom or third-party shortcuts in active use. Within 7 days: Deploy July 2025 or later macOS security updates (Ventura 13.6+, Sonoma 14.6+, Sequoia 15.1+ or later) to all affected devices via MDM; restrict shortcut creation/distribution via mobile device management policies. Within 30 days: Audit execution logs for suspicious shortcut activity and conduct user awareness training on risks of importing shortcuts from untrusted sources.

macOS CVE-2025-43184

CRITICAL

Improper Access Control (CWE-284)

2025-07-30 product-security@apple.com

Apple macOS Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings.

AnalysisAI

Authentication bypass in macOS Shortcuts allows malicious shortcuts to circumvent sensitive app settings without user consent across macOS Ventura 13.x, Sonoma 14.x, and Sequoia 15.x prior to July 2025 security updates. Despite a critical CVSS 9.8 score suggesting network-based exploitation, the vulnerability actually requires local shortcut execution with no authentication (PR:N), making the CVSS vector potentially misaligned with the actual attack surface. No public exploit identified at time of analysis, with EPSS score of 0.08% (24th percentile) indicating low predicted exploitation probability. Apple fixed the issue by adding mandatory user consent prompts.

Technical ContextAI

The vulnerability resides in Apple's Shortcuts framework (CWE-284: Improper Access Control), a macOS automation system that allows users to create workflows with system-level capabilities. Shortcuts can interact with sensitive system settings, privacy controls, and application data. The flaw permitted a crafted shortcut to bypass permission checks that normally protect sensitive Shortcuts app configuration settings, executing privileged actions without triggering user consent prompts. This represents a failure in the authorization boundary between user-created automation scripts and protected system resources. The affected CPE strings indicate all three currently-supported macOS major versions were vulnerable: Ventura (13.x prior to 13.7.7), Sonoma (14.x prior to 14.7.7), and Sequoia (15.x prior to 15.4). The fix involved adding explicit consent prompts before allowing shortcuts to modify or access protected settings, implementing proper authorization gates that were previously missing.

RemediationAI

Vendor-released patches are available: upgrade to macOS Ventura 13.7.7, macOS Sonoma 14.7.7, or macOS Sequoia 15.4, all released in July 2025. Apply security updates through System Settings > General > Software Update or via Apple's enterprise deployment tools. Full remediation details are documented in Apple security advisories at https://support.apple.com/en-us/122373 (Ventura), https://support.apple.com/en-us/124150 (Sonoma), and https://support.apple.com/en-us/124151 (Sequoia). As a temporary mitigation for environments unable to immediately patch, restrict shortcut installation to trusted sources only, disable untrusted shortcut execution in System Settings > Privacy & Security > Shortcuts, and audit existing installed shortcuts for suspicious permission requests. However, these workarounds do not fully address the underlying authorization bypass and should not replace timely patching.