CVE-2026-12374: Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool

Severity: medium (CVSS 6.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-01 · updated 2026-10-25
Weakness: CWE-295

Description

Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.

Affected products

Cato Networks SDP Client: from 5.12.0 before 5.13.1 — fixed in 5.13.1

How to fix

Upgrade to a fixed version: Cato Networks SDP Client 5.13.1. Check the vendor advisory for mitigations.

References

https://support.catonetworks.com/hc/en-us/articles/37284626576413-Security-Vulnerability-CVE-2026-12374-that-Impacts-macOS-Client-Versions-Lower-than-5-13-1

Get alerted when CVE-2026-12374 or the next vulnerability affects your stack