Clearancekit EUVD-2026-16371

Requires local process execution on macOS running ClearanceKit versions 4.1 and earlier. Low-privilege authenticated user can bypass file access policy by performing file operations (rename, unlink, etc.) not monitored by the opfilter Endpoint Security extension.

Real-world risk is HIGH for organizations deploying ClearanceKit as a security control. CVSS 8.7 (High) with AV:L/AC:L/PR:L indicates local attack vector with low complexity and low privileges required, making exploitation trivial for any user with local access including malware or compromised accounts. The scope change (S:C) reflects that bypassing a security product affects resources beyond the vulnerable component itself. No EPSS data is provided, and no public exploit identified at time of analysis, reducing immediate urgency. However, the vulnerability completely undermines the product's core security function (file access policy enforcement), making it a critical priority for ClearanceKit deployments despite lack of public exploitation. The low attack complexity and authentication requirement of only PR:L mean any malicious process or insider can trivially bypass controls. From SSVC perspective: high technical impact (security product bypass), not currently exploitable in the wild per available data, but highly automatable once discovered.

A local attacker with standard user privileges runs a malicious process on a macOS system protected by ClearanceKit 4.1 or earlier. Rather than using standard file open operations that would be intercepted and blocked by policy, the attacker's code uses rename, unlink, or one of five other unmonitored file operation syscalls to access, modify, or delete protected files. The opfilter extension fails to intercept these events, allowing the operations to succeed without policy evaluation or audit logging, completely bypassing the intended file access controls. No public exploit identified at time of analysis, but attack complexity is low (CVSS AC:L) making independent development trivial.