[texas booster]

Does this exploit require physical access to the computer to bypass credentials?

If so we are safe, and will update after the mad rush is over.

[SES1066]

If one can VPN or otherwise access to an ‘on’ and on-line machine, then doing the ‘root’ logon might be possible. The update takes less than a minute on my 2014 iMac without any need to reboot!

[Swordmaker]

Does this exploit require physical access to the computer to bypass credentials?

Yes, but someone tried to claim not. It can only be done at the keyboard. It could be avoided by enabling Root yourself and adding a complex password of your own choice. Then it won't work.