Cisco Trust Agent (CTA) before 2.1.104.0 when running on MacOS X allows attackers with physical access to bypass authentication and modify System Preferences including passwords by invoking the Apple Menu when the Access Control Server (ACS) produces a user notification message after posture validation.