Is CVE-2026-40191 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-40191, but active exploitation has not been confirmed.

Can CVE-2026-40191 be exploited remotely?

No. CVE-2026-40191 requires local access to exploit.

What is the CVSS score of CVE-2026-40191?

CVE-2026-40191 has a CVSS score of 6.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40191

MEDIUMPOC

CVE-2026-40191

CWE-863Published: April 10, 2026· Updated: Apr 16, 2026

6.8

CVSS v3.1

Official Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

NVD Source

Technical Analysis

CVE-2026-40191 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2026-40191. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X