CVE-2026-12374— Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool
Possible ATT&CK Techniques 1AI
T1548.001 · Setuid and SetgidAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cato Networks | SDP Client | 5.12.0< 5.13.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12374
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cato Networks | SDP Client | 5.12.0 ~ 5.13.1 | - |
II. Public POCs for CVE-2026-12374
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12374
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12374 (1)
IV. Related Vulnerabilities
Same product: SDP Client
- CVE-2025-3886
CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race - CVE-2024-6978
Cato Networks Windows SDP Client Local root certificates can - CVE-2024-6977
Cato Networks Windows SDP Client Sensitive data in trace log - CVE-2024-6975
Cato Networks Windows SDP Client Local Privilege Escalation - CVE-2024-6974
Cato Networks Windows SDP Client Local Privilege Escalation
Same vendor: Cato Networks
- CVE-2025-14213
Cato's Socket WebUI is vulnerable to OS Command Injection - CVE-2025-7012
Cato Networks Linux Client Local Privilege Escalation via Sy - CVE-2025-3886
CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race - CVE-2024-6978
Cato Networks Windows SDP Client Local root certificates can - CVE-2024-6977
Cato Networks Windows SDP Client Sensitive data in trace log
Same weakness: CWE-295
- CVE-2026-8480
Connection possible to the Administration portal with a revo - CVE-2026-7532
iPAddress name constraints not enforced when WOLFSSL_IP_ALT_ - CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_r - CVE-2026-6450
CRL critical extension bypass in ParseCRL_Extensions - CVE-2026-6731
X.509 name constraint bypass via Subject CN treated as a DNS
V. Comments for CVE-2026-12374
No comments yet