Security readout for executives and security teams
Plain-English summary
This vulnerability affects older BeyondTrust Privilege Management for Mac installations. A low-privileged authenticated user could gain root-level control during installation by abusing insecure temporary-directory script handling. The business risk is full compromise of affected Mac endpoints, but the source bundle does not show known active exploitation.
Executive priority
Treat this as a high-priority endpoint hygiene issue for organizations using BeyondTrust on Mac. It is not currently evidenced as actively exploited in the supplied sources, but affected systems allow a low-privileged user to become root during installation, which can defeat endpoint security boundaries.
Technical view
CVE-2021-3187 is a CWE-276 permissions issue in BeyondTrust Privilege Management for Mac before 5.7. During install time, an authenticated unprivileged user could cause a malicious script from a temporary directory to execute as root. Sources limit macOS exposure to versions before 10.15.5, or Mojave/High Sierra before Security Update 2020-003.
Likely exposure
Exposure is most likely on Macs running BeyondTrust Privilege Management for Mac below 5.7 and older vulnerable macOS builds. Later macOS versions are described as not vulnerable. Organizations without endpoint software inventory may have uncertainty around legacy Macs, older installers, or delayed BeyondTrust upgrades.
Exploitation context
The bundled sources do not report active exploitation, and the CVE is not marked as CISA KEV. Exploitation requires an authenticated unprivileged user and appears tied to installation timing. Successful abuse would provide root privileges, creating high confidentiality, integrity, and availability impact on the endpoint.
Researcher notes
The CVSS score is 8.8 with full CIA impact. The description ties exploitability to install-time behavior and vulnerable macOS versions. Public affected CPE data is absent in the bundle, so product exposure should be validated through software inventory and vendor release/advisory records rather than broad assumptions.
Mitigation direction
- Upgrade BeyondTrust Privilege Management for Mac to 5.7 or later.
- Update macOS to 10.15.5 or later where feasible.
- Apply Security Update 2020-003 on Mojave or High Sierra systems.
- Check BeyondTrust advisory BT22-06 for vendor-specific remediation guidance.
- Prioritize Macs with shared access, admin tooling, or sensitive data.
Validation and detection
- Inventory BeyondTrust Privilege Management for Mac versions across managed Macs.
- Identify Macs below macOS 10.15.5 or missing Security Update 2020-003.
- Confirm no production endpoints run BeyondTrust versions before 5.7.
- Review endpoint management records for stale installers or deferred upgrade groups.
- Document exceptions and verify compensating controls against vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-3187 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.