Cato Networks macOS Client Vulnerability Enables Low-Privilege Code Execution

ZDI disclosed a TOCTOU local privilege escalation (ZDI-25-252, CVSS 7.8) in Cato Networks' macOS VPN client that allows low-privileged users to manipulate the installation process and execute code as root via the Helper service; ZDI published the advisory after Cato had not issued a patch, and organizations are advised to restrict local access, monitor helper services, audit deployments, and apply Cato’s patch once released.