Loading story…
Quarkslab reported a security issue in the Cato VPN Client tracked as CVE-2026-10739. The report identifies split-tunnel behavior and local privilege escalation as affected security areas, potentially allowing a local attacker to undermine endpoint network-routing controls and obtain elevated permissions.
The issue is notable in the context of Windows privilege-escalation techniques that abuse unsafe file operations, including arbitrary file deletion. Organizations using the Cato VPN Client should identify deployed versions, obtain vendor guidance on affected releases and remediation, and prioritize updates or mitigations on systems where non-administrative users can execute code.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate local privilege-escalation issues were disclosed in widely deployed Windows remote-access clients. WatchGuard published an advisory for **NCP IPSec VPN Client** as shipped with *WatchGuard Mobile VPN with IPSec* for Windows, where installation/update/uninstall actions can briefly open interactive `cmd.exe` windows running as **SYSTEM**; on older Windows versions, an attacker with local access can execute commands in that prompt to gain **SYSTEM** privileges and bypass administrative protections. WatchGuard states the issue affects versions up to **15.19** and is fixed in **15.33** (advisory **WGSA-2026-00002**, tracked as **NCPVE-2025-0626**). Separately, reporting described a privilege-escalation weakness in **Check Point Harmony SASE (Perimeter81) Windows client** tracked as **CVE-2025-9142**, affecting versions **below 12.2**. The issue is attributed to insufficient validation of **JWT** values passed via a URI handler (`perimeter81://`) to a SYSTEM-privileged service component (`Perimeter81.Service.exe`), enabling directory traversal (e.g., `../../../`) and file write/delete outside the intended certificate working directory; the described attack chain includes crafting a malicious URL, abusing a whitelisted auth domain, and using symlink/object-manager tricks to redirect certificate writes performed with SYSTEM privileges, potentially leading to full local compromise.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-11462, was discovered in the AWS Client VPN application for macOS, allowing local users to escalate privileges to root. The flaw, which received a CVSS score of 9.3, is caused by improper link resolution before file access in the AWS VPN Client for macOS versions 1.3.2 through 5.2.0. Insufficient validation checks on the log destination directory during log rotation enable a non-administrator user to create a symbolic link from a client log file to a privileged location. When log rotation occurs, this symlink can be exploited to inject arbitrary code into the log file, which is then executed with root privileges. The vulnerability is not remotely exploitable, requiring local access to the affected system. Security researchers highlighted that a crafted API call could be used to inject malicious code into the log file, further increasing the risk of exploitation. AWS has released a patched version, AWS VPN Client for macOS 5.2.1, and strongly recommends all users upgrade to this or the latest available version to mitigate the risk. The vulnerability was publicly disclosed on October 7, 2025, and has been classified as critical due to the potential for full system compromise. No evidence of active exploitation in the wild has been reported at the time of disclosure, but the technical details suggest that exploitation would be straightforward for a local attacker. The flaw does not affect other operating systems or AWS VPN clients for platforms other than macOS. Organizations using affected versions are urged to update immediately and review system logs for any signs of suspicious activity. The vulnerability underscores the importance of secure log handling and proper validation of file operations in privileged applications. Security advisories recommend restricting local access to systems running vulnerable versions until patches are applied. The issue was identified and reported through responsible disclosure channels, and AWS responded promptly with a fix. The vulnerability highlights ongoing risks associated with privilege escalation flaws in widely used enterprise software.
Jul 12, 2026
Check Point issued emergency updates for two critical vulnerabilities, **CVE-2026-85102** and **CVE-2026-85103**, affecting Quantum Security Gateways, Security Management systems, Spark Firewalls, and Remote Access and Site-to-Site VPN deployments. An unauthenticated attacker could exploit flaws in certificate handling during VPN negotiation to execute arbitrary code on exposed perimeter appliances; CVE-2026-85102 involves improper certificate validation and authentication bypass, while CVE-2026-85103 is a heap overflow in ASN.1 certificate decoding. Check Point has provided fixes through LivePatch and Jumbo Hotfix Accumulator packages. Organizations should apply available updates promptly and, where patching is delayed, reduce VPN exposure using implied-rule and UDP-port controls. No public proof-of-concept exploit was reported at disclosure, but internet-facing VPN infrastructure is a high-priority remediation target.
Sep 15, 2026