CVE-2026-12374: Cato Client Privilege Escalation Flaw

CVE-2026-12374 Overview

CVE-2026-12374 is a local privilege escalation vulnerability in the Cato Client for macOS. The flaw resides in the PrivilegedHelperTool XPC service and combines two defects: improper certificate validation [CWE-295] and a time-of-check time-of-use (TOCTOU) race condition. A local authenticated attacker can present a self-signed certificate to bypass XPC caller verification, then swap a symlink during package installation to escalate privileges to root. Cato Networks addressed the issue in Cato Client version 5.13.1 for macOS.

Critical Impact
A local authenticated user on macOS can execute arbitrary code as root by chaining an XPC caller verification bypass with a symlink swap during package installation.

Affected Products

Cato Client for macOS versions prior to 5.13.1
The PrivilegedHelperTool XPC service component
Package installation workflow on macOS hosts running the Cato Client

Discovery Timeline

2026-07-01 - CVE-2026-12374 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-12374

Vulnerability Analysis

The Cato Client for macOS installs a PrivilegedHelperTool that runs with elevated privileges and exposes an XPC service. Client applications call this service to perform tasks that require root, such as installing or updating packages. The helper is expected to verify that the caller connecting over XPC is a legitimate, Apple-signed Cato binary before honoring privileged requests.

The helper's caller verification relies on certificate checks that accept self-signed certificates. An attacker can produce a binary signed with a self-signed certificate and connect to the XPC service. The helper treats the caller as trusted and processes the request as if it originated from the vendor's own client.

Once authorized, the attacker triggers a package installation workflow. The helper validates a file path, then later opens or copies the file at that path. Between those two operations, the attacker swaps the target with a symbolic link that points to a location the attacker controls. The privileged helper follows the symlink and performs its write or execute action as root, giving the attacker code execution with full system privileges.

Root Cause

The root cause is twofold. First, the XPC caller verification logic does not enforce that the peer binary is signed by the expected Apple Developer ID or team identifier, so a self-signed certificate is sufficient to pass validation. Second, the installer path in the helper uses non-atomic filesystem operations, creating a TOCTOU window between path validation and path use.

Attack Vector

The attacker requires local authenticated access to a macOS system running a vulnerable Cato Client. The attacker builds a helper client signed with an attacker-controlled self-signed certificate, connects to the PrivilegedHelperTool XPC endpoint, and requests a package installation. During the installation flow, the attacker races the helper to replace a validated file or directory with a symlink pointing at a root-owned target. No user interaction is required and the attack completes locally without network access.

No public proof-of-concept code has been verified for this issue. See the Cato Networks Security Advisory for vendor technical details.

Detection Methods for CVE-2026-12374

Indicators of Compromise

Unexpected child processes spawned by the Cato PrivilegedHelperTool running as root.
Creation of symbolic links inside directories used by the Cato installer during package operations.
XPC connections to the Cato helper originating from binaries signed with non-Cato or self-signed certificates.
Modifications to root-owned files or LaunchDaemons timed to Cato Client update or install events.

Detection Strategies

Monitor macOS Endpoint Security events for ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_CREATE involving symlink creation inside Cato installer working directories.
Alert on process executions where the parent is the Cato PrivilegedHelperTool and the child is not a known Cato binary path.
Inspect code signing information of processes connecting to the Cato XPC service and flag self-signed or ad-hoc signed binaries.

Monitoring Recommendations

Baseline the set of binaries that legitimately invoke the Cato helper and alert on deviations.
Log filesystem operations in /Library/Application Support/Cato and /tmp paths used during installation for review after Cato Client upgrades.
Correlate local privilege escalation telemetry with Cato Client version inventory to prioritize hosts still running versions below 5.13.1.

How to Mitigate CVE-2026-12374

Immediate Actions Required

Upgrade all macOS endpoints to Cato Client version 5.13.1 or later without delay.
Inventory macOS assets and identify any hosts still running Cato Client versions below 5.13.1.
Restrict local login on shared macOS systems until patching is complete, since exploitation requires local authenticated access.

Patch Information

Cato Networks released Cato Client 5.13.1 for macOS, which corrects the XPC caller verification logic and removes the TOCTOU condition in the package installation flow. Refer to the Cato Networks Security Advisory for the official update guidance and download links.

Workarounds

No vendor-supplied workaround replaces the patch; upgrading to 5.13.1 is the only supported remediation.
Limit local accounts on macOS endpoints and enforce least privilege to reduce the pool of users who can reach the XPC service.
Use mobile device management (MDM) tooling to enforce the fixed Cato Client version across the fleet and block downgrade.

bash

# Verify installed Cato Client version on macOS
/Applications/Cato\ Client.app/Contents/MacOS/CatoClient --version

# Confirm the version reports 5.13.1 or later; otherwise upgrade via MDM or the Cato-provided installer