CVE-2022-22675

An out-of-bounds write vulnerability in macOS Monterey allowed arbitrary kernel code execution, was actively exploited in the wild, and remains unpatched in KEV.

This CVE demonstrates how a single unpatched kernel vulnerability can grant attackers full system control, directly violating CMMC/NIST 800-171 requirements for patch management and vulnerability mitigation. DIB organizations must enforce strict patching SLAs and monitor KEV for actively exploited flaws to prevent similar compromises.

Shame score — The vulnerability was actively exploited in the wild and remains in KEV, indicating prolonged exposure and a failure to patch a critical kernel flaw before it was weaponized.