A quick mitigation workaround: If you follow the steps here https://support.apple.com/en-us/HT204012 https://support.apple.com/en-us/HT204012 to disable the roo

A quick mitigation workaround: If you follow the steps here https://support.apple.com/en-us/HT204012 https://support.apple.com/en-us/HT204012 to disable the root account until the point where you open and authenticate the Directory Utility, in the Edit menu there's a "Change Root Password" option. Set a good password there and disable the root account again. Now people making use of this vulnerability will still be able to re-enable the root account (that's why it fail the first time - root is default off, but this bug enables it), but now there will at least be a useful password set.