CVE-2015-7007: Apple OS X Script Editor AppleScript confirmation bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated bypass of a security confirmation leading to AppleScript execution, with public exploit references and a very high EPSS score, though no KEV listing.

What it is

Script Editor in Apple OS X before 10.11.1 fails to enforce an intended user-confirmation step before executing AppleScript. This lets a remote attacker run AppleScript without the prompt that is supposed to gate execution, undermining a key trust control on the host. The record gives no detail on the underlying mechanism, only that the vectors are unspecified.

Impact

An attacker can execute AppleScript on the target without the expected user confirmation, which can lead to arbitrary code execution in the user's context. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

The CVSS 2.0 vector is network-reachable with low complexity and no authentication (AV:N/AC:L/Au:N), and the referenced exploit is a Safari user-assisted AppleScript execution attack, so some user interaction (visiting a page) is implied by the exploit name even though the description does not state it. No credentials are required.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.533 for 30 days (99th percentile), and public exploit references exist (Exploit-DB 38535, Packet Storm, Rapid7 module), indicating known public exploitation techniques.

What to do

• Upgrade Apple OS X to 10.11.1 or later, which the vendor advisory states fixes this issue.
• If immediate upgrade is not possible, restrict or disable automatic AppleScript execution paths and review Script Editor usage on affected hosts.
• Harden browser settings and user awareness to reduce the chance of user-assisted execution from Safari.
• Monitor Apple security announcements for any follow-up guidance on this issue.

Detection

• Alert on Script Editor or osascript spawning unexpectedly, especially when the parent process is a browser such as Safari.
• Look for AppleScript execution events that occur without a corresponding user confirmation prompt in endpoint telemetry.
• Correlate Safari browsing activity with subsequent script interpreter process creation on the same host.
• Review endpoint logs for unusual child processes of Script Editor or osascript on unpatched OS X versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.