Description
Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
Published: 2026-07-01
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper validation of the XPC caller certificate in the PrivilegedHelperTool service of the Cato Networks SDP Client permits a local authenticated attacker to bypass the certificate chain checks and gain root privileges. The vulnerability also includes a time‑of‑check time‑of‑use race condition that can be exploited by swapping a symbolic link during installation, allowing the helper tool to run with elevated rights. The flaw therefore permits arbitrary privileged execution locally through either certificate manipulation (CWE‑295) or a symlink race (CWE‑367).

Affected Systems

Cato Networks SDP Client on macOS versions earlier than 5.13.1 are affected; no other vendors or operating systems are mentioned.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate risk, while < 1 % shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authentication or control during the installation process, and the attack cannot be performed remotely; it is limited to users who can execute local code or influence the installation sequence.

Generated by OpenCVE AI on August 1, 2026 at 23:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Cato Client to version 5.13.1 or later, which fixes the certificate validation and TOCTOU race condition.
  • Reinstall the client after the upgrade to ensure the helper tool is installed with a valid system signature and to remove any vulnerable symlinks created by earlier versions.
  • Configure the privileged helper tool directory to have strict permissions (e.g., 700) to prevent symbolic‑link manipulation during future installations.

Generated by OpenCVE AI on August 1, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Catonetworks
Catonetworks sdp Client
Vendors & Products Catonetworks
Catonetworks sdp Client

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
Title Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool
Weaknesses CWE-295
CWE-367
References
Metrics cvssV4_0

{'score': 6.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/R:U/V:C/RE:L/U:Amber'}

Subscriptions

Catonetworks Sdp Client
cve-icon MITRE

Status: PUBLISHED

Assigner: Cato

Published:

Updated: 2026-07-01T15:07:24.153Z

Reserved: 2026-06-16T07:28:42.180Z

Link: CVE-2026-12374

cve-icon Vulnrichment

Updated: 2026-07-01T15:07:21.240Z

cve-icon NVD

Status : Deferred

Published: 2026-07-01T15:16:27.100

Modified: 2026-07-02T17:44:12.130

Link: CVE-2026-12374

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:30:04Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition