CVE-2015-1130VulnerabilityPublished 02/10/2022Updated 10/24/2026

CVE-2015-1130: Apple OS X Authentication Bypass Vulnerability

Affects Apple OS XSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 02/10/2022
KEV deadline: 08/10/2022
EPSS: 9.9% chance of exploitation in 30 days – higher than 95% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2015-1130 (opens in a new tab)

Affected software

Product	Affected	Fixed in
Apple OS X	Affected <10.10.3	Fixed in–

Description

CVE-2015-1130 is an authentication bypass vulnerability in the XPC implementation of the Admin Framework in Apple OS X versions prior to 10.10.3. This flaw allows local users to bypass authentication mechanisms and gain administrative privileges on affected systems. The vulnerability has been exploited in the wild. No explicit patch links are provided in the input data, but the vulnerability affects OS X versions before 10.10.3.

Summary

The vulnerability exists in the XPC implementation within the Admin Framework of Apple OS X before version 10.10.3. It enables local users to bypass authentication controls and escalate privileges to administrator level. This flaw is tracked as CVE-2015-1130 and is associated with CWE-254 (Security Features). Exploitation of this vulnerability has been observed in the wild, indicating active threat usage.

Impact

Successful exploitation allows a local user to bypass authentication and obtain administrative privileges on the affected Apple OS X system. This can lead to full system compromise by unauthorized users with local access.

Mitigation

A fix is available in Apple OS X version 10.10.3 and later. Users should upgrade to OS X 10.10.3 or a later version to remediate this vulnerability. Since the input does not provide explicit patch links or vendor advisory text, verify the patch status with official Apple security advisories before applying.

Weaknesses

CWE-254Unclassified weakness (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 10:10:56 UTC

Weaknesses

References

Related threats