Symantec CleanWipe CVE-2026-11626

Exploitation requires all of the following: (1) Local access to the macOS endpoint - no remote exploitation path exists (AV:L). (2) High privileges on the part of the attacker (PR:H per CVSS 4.0) - note a conflict exists between this metric and the description's 'limited privilege' language; the exact required privilege level should be confirmed against the Broadcom advisory. (3) Active user interaction (UI:A) - an administrator or privileged user must actively invoke the CleanWipe Removal Tool, so exploitation is dependent on a removal workflow being in progress. (4) Specific attack preconditions must be present (AT:P) - the exact environmental or configuration prerequisites are not fully disclosed in available data and should be reviewed in the vendor advisory. Exploitation is NOT possible remotely, is NOT possible passively without user interaction, and is NOT applicable to platforms other than macOS based on available tags.

The CVSS 4.0 base score of 5.4 (Medium) reflects meaningful mitigating factors in the attack vector. AV:L confirms exploitation is restricted to local access only - there is no remote attack surface. AT:P (Attack Requirements: Present) indicates that specific environmental conditions or configurations must exist before exploitation is possible, reducing opportunistic risk. PR:H signals that the CVSS scoring authority assessed the attacker as requiring high-level privileges to initiate the exploit. There is a notable tension between the CVSS PR:H metric and the CVE description's language of 'attacker with limited privilege access' - this discrepancy should be verified with the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37625, as it could indicate that 'limited privilege' refers to a Symantec application role rather than OS-level user privilege, or that the CVSS vector was scored conservatively. UI:A (Active User Interaction required) further constrains exploitation - an administrator or privileged user must actively trigger the CleanWipe tool for the attack window to exist. No EPSS score was provided, and this CVE does not appear in the CISA KEV catalog, suggesting no confirmed active exploitation in the wild. Real-world risk is moderate and primarily meaningful in environments where CleanWipe is actively used for SEP removal workflows on macOS fleets.

A local attacker who has obtained some degree of privileged access on a macOS system - for example, via a compromised admin account or an application-level Symantec role - waits for or induces an administrator to launch the CleanWipe Removal Tool to uninstall Symantec Endpoint Protection. During the active, user-initiated removal session (satisfying the UI:A and AT:P requirements), the attacker leverages the tool's excessive process privileges (CWE-250) to redirect execution or manipulate the privileged context to gain full administrative control of the macOS system. No public proof-of-concept exploit code has been identified at time of analysis.