Hillel Pinto

**Name of the Vulnerable Software and Affected Versions** Sophos Endpoint for macOS versions prior to 2026.1.1 Sophos Home for macOS versions prior to 10.11.6 **Description** A privilege escalation issue allows local users to execute arbitrary code with root privileges. **Recommendations** Update Sophos Endpoint for macOS to version 2026.1.1 or later. Update Sophos Home for macOS to version 10.11.6 or later.

**Name of the Vulnerable Software and Affected Versions** Kandji Agent versions prior to 4.7.5(5374) **Description** A client validation gap in the software allows a local attacker to escalate privileges and invoke restricted agent functionality. **Recommendations** Update to version 4.7.5(5374) or later.

**Name of the Vulnerable Software and Affected Versions** JumpCloud Remote Assist for Windows versions prior to 0.317.0 **Description** An issue exists in the uninstaller of JumpCloud Remote Assist for Windows, which is executed by the JumpCloud Windows Agent with NT AUTHORITYSYSTEM privileges during update or uninstall operations. The uninstaller performs privileged create, write, execute, and delete actions on predictable files within a user-writable `%TEMP%` subdirectory without validating the directory's trust or resetting its Access Control Lists (ACLs). A local, low-privileged attacker can pre-create this directory with weak permissions and use mount-point or symbolic-link redirection to force arbitrary file writes to protected locations, potentially causing a denial of service by overwriting system files. Additionally, an attacker may redirect the `DeleteFileW()` function to target specific files or folders, enabling arbitrary deletion and local privilege escalation to SYSTEM. This issue potentially affects over 180,000 organizations globally. **Recommendations** Update JumpCloud Remote Assist for Windows to version 0.317.0.