What’s Vulnerable › Vulnerabilities

CVE-2025-11462: Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-07 · updated 2026-10-08
• Weakness: CWE-59

Description

Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a symlink from a client log file to a privileged location. On log rotation, this could lead to code execution with root privileges if the user made crafted API calls which injected arbitrary code into the log file. We recommend users upgrade to AWS VPN Client for macOS 5.2.1 or the latest version.

Affected products

• AWS Client VPN: from 1.3.2 before 5.2.1 — fixed in 5.2.1

How to fix

Upgrade to a fixed version: AWS Client VPN 5.2.1. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-020/
• https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-macos-release-notes.html

Get alerted when CVE-2025-11462 or the next vulnerability affects your stack