CVE-2026-43728 is a Keychain vulnerability in macOS Tahoe 26.6 with a CVSS of 7.5, but the low EPSS (0.00195) creates an incomplete risk picture that deserves scrutiny rather than reassurance.
The core problem: Apple's description—allowing an attacker to 'modify the state of the Keychain'—is deliberately abstract. The word 'state' is doing unusual work here. Keychain vulnerabilities are typically described in terms of access, extraction, or disclosure when credential theft is the concern. 'State modification' suggests the attacker operates one layer abstracted from the secrets themselves—corrupting, reordering, or manipulating Keychain data structures without necessarily reading encrypted payloads. This matters because it could mean a sandboxed app with restricted Keychain entitlements could destabilize credential storage for other apps, or a local attacker could cause authentication failures by corrupting state rather than credentials.
The 'improved state management' fix language is Apple's standard obfuscation for logic errors where they refuse to characterize root causes. This likely indicates a TOCTOU (time-of-check-time-of-use) vulnerability in the separation between Keychain's authorization checks and state transitions—a pattern Apple's API architecturally encourages by decoupling these operations. The historical record supports this: CVE-2018-4249, CVE-2019-8507, CVE-2020-10006 and others all received similar 'improved state management' language, suggesting Apple patches specific call sites without revising the underlying API contract that makes such bugs nearly inevitable.
For defenders, the critical questions are: (1) Does this vulnerability allow state modification across Keychain access groups, or only within the attacking app's own items? The answer determines whether this is an intra-app or inter-app attack surface. (2) Does it require prior authentication to a specific Keychain item, or can it be triggered without? (3) Given Apple's historical pattern of localized fixes rather than architectural revision, treat this as one instance of a recurring class—monitor for similar disclosures and press vendors for explicit confirmation of access-group isolation in your environment.
The EPSS/CVSS inconsistency should not comfort you. Apple vulnerabilities score low on automated exploitation predictors because the attack surface requires authenticated, entitlements-constrained contexts that resist mass automation. In enterprise environments where users run third-party apps with constrained Keychain access, that low EPSS masks a high human-assessed risk. Patch macOS Tahoe 26.6 when available, but recognize that 'improved state management' language likely means you've patched one variant of an unresolved architectural problem—not closed the door definitively.