CVE-2025-31194

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-31194", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-27T16:13:58.312Z", "datePublished": "2025-03-31T22:22:54.641Z", "dateUpdated": "2026-07-08T14:10:40.701Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A Shortcut may run with admin privileges without authentication"}]}], "affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "13.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "14.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication."}], "references": [{"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122374"}, {"url": "https://support.apple.com/en-us/122375"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:12:26.446Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-01T14:34:18.723624Z", "id": "CVE-2025-31194", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T14:10:40.701Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Apr/10"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/9"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:17:17.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Apr/10"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/9"}, {"url": "http://seclists.org/fulldisclosure/2025/Apr/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:17:17.468Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-31194", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-01T14:34:18.723624Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T14:35:15.380Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "13.7.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "14.7.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "15.4", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/122373"}, {"url": "https://support.apple.com/en-us/122374"}, {"url": "https://support.apple.com/en-us/122375"}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "A Shortcut may run with admin privileges without authentication"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:12:26.446Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31194", "state": "PUBLISHED", "dateUpdated": "2026-07-08T14:10:40.701Z", "dateReserved": "2025-03-27T16:13:58.312Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-03-31T22:22:54.641Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "13.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "14.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "345CC17A-CCA4-4B82-A645-A5226A8DAEBB", "versionEndExcluding": "13.7.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "D05DCA25-A1A0-4AEA-9F31-952803114EE2", "versionEndExcluding": "14.7.5", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "1320B815-0457-4276-83B9-AFAFDAF17EDA", "versionEndExcluding": "15.4", "versionStartIncluding": "15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de autenticaci\u00f3n mejorando la gesti\u00f3n del estado. Este problema se solucion\u00f3 en macOS Ventura 13.7.5, macOS Sequoia 15.4 y macOS Sonoma 14.7.5. Un acceso directo puede ejecutarse con privilegios de administrador sin autenticaci\u00f3n."}], "evaluatorComment": "ept the ", "id": "CVE-2025-31194", "lastModified": "2026-06-17T09:09:59.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31194", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-01T14:34:18.723624Z", "version": "2.0.3"}}]}, "published": "2025-03-31T23:15:29.350", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122373"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122374"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122375"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Apr/9"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:05:48.433230+00:00", "value": {"mitigation_remediation": ["Apply the latest macOS update (Sequoia\u00a015.4 or newer, Sonoma\u00a014.7.5 or newer, Ventura\u00a013.7.5 or newer) to address the authentication bug.", "Configure macOS to restrict or block the execution of shortcuts that run with privileged rights, for example by reviewing Shortcuts permissions or using the Shortcuts app\u2019s \u201cShare with Others\u201d setting.", "Monitor system logs and audit Shortcut execution events for unauthorized elevation attempts, and consider disabling the shortcuts service on systems where it is not needed."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The flaw impacts Apple macOS versions prior to Sequoia\u00a015.4, Sonoma\u00a014.7.5, and Ventura\u00a013.7.5. Users running any earlier release of these operating systems are susceptible to this privilege escalation.\n", "description_and_impact": "An authentication flaw allows a macOS Shortcut to execute with administrator privileges without proper authentication. The vulnerability stems from inadequate state management during Shortcut execution, enabling an attacker to elevate privileges on the affected system. The resulting compromise grants full control of the machine, including the ability to install malware, modify system settings, or exfiltrate data.\n", "risk_and_exploitability": "The CVSS score of 9.8 reflects the severe potential consequences of this vulnerability. Although the EPSS score indicates exploitation probability is below 1%, the flaw is not listed in CISA\u2019s KEV catalog. The attack vector is inferred to require the execution of a malicious Shortcut; an attacker could deliver the Shortcut via one\u2011click downloads, phishing, or scripts that run automatically.\n"}}}}, "created": "2026-04-28T03:15:05.542224+00:00", "title": "Privilege Escalation via Unauthenticated Shortcut Execution", "updated": "2026-04-28T03:15:05.542234+00:00", "vendors": []}