The vulnerability CVE-2026-12374 affects Cato Networks SDP Client on macOS before version 5.13.1, specifically version 5.12.0. It arises from improper certificate validation and a TOCTOU race condition in the PrivilegedHelperTool XPC service. An attacker with local authenticated access can exploit this by presenting a self-signed certificate that bypasses the XPC caller verification mechanism. Additionally, a symlink swap during package installation can be leveraged to escalate privileges to root. The CVSS 4.0 base score is 6.4, indicating medium severity. No official patch or remediation level has been published by the vendor as of the data provided.

A local authenticated attacker can escalate privileges to root on the affected system by exploiting improper certificate validation and a race condition in the PrivilegedHelperTool XPC service. This could lead to full system compromise by the attacker. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Cato Networks advisories for updates. Until a fix is available, restrict local authenticated access to trusted users and consider additional local security controls to mitigate risk.