Critical privilege escalation vulnerability reported in AWS Client VPN for macOS
Take action: If you're using AWS Client VPN on macOS, check your version and upgrade to version 5.2.1 or later as soon as possible. The exploit requires access to the computer, but even that can be achieved with some malware through phishing or "free" apps.
Learn More
Amazon Web Services is reporting a critical security vulnerability in the macOS version of its Client VPN software that could allow local attackers with limited system access to escalate privileges and execute arbitrary code with root-level permissions.
AWS Client VPN is a managed, client-based VPN service that enables secure remote access to AWS and on-premises resources across Windows, macOS, and Linux platforms.
The flaw is tracked as CVE-2025-11462, (CVSS score 9.3) and is caused by insufficient validation checks during the client's log rotation process. The macOS version of the AWS VPN Client lacks proper validation checks on the log destination directory during log rotation. This allows a non-administrator user with local access to the system to create a symbolic link (symlink) from the client's log file to a privileged system location, such as the crontab file located at /etc/crontab, which is used by the Unix cron daemon to schedule automated tasks with root privileges.
The macOS implementation of the AWS Client VPN client and does not affect Windows or Linux versions of the software. AWS released Security Bulletin AWS-2025-020 on October 7, 2025, detailing the flaw and providing remediation guidance for affected users. The vulnerability arises from a fundamental weakness in how the macOS client handles log file management during routine log rotation operations, which occur automatically as part of normal application maintenance procedures.
By redirecting log output to the system's crontab file, the attacker can inject cron job entries that will be executed automatically by the cron scheduler with root-level permissions. This allows the attacker to execute arbitrary commands with complete system privileges, effectively gaining full administrative control over the compromised macOS device.
Affected versions are AWS Client VPN Client versions 1.3.2 through 5.2.0 (macOS only)
Versions not affected:
- AWS Client VPN Client version 5.2.1 and later (macOS)
- All Windows versions of AWS Client VPN Client
- All Linux versions of AWS Client VPN Client
AWS has patched the vulnerability in Client VPN Client version 5.2.1. Organizations using AWS Client VPN on macOS devices should upgrade to version 5.2.1 or the latest available version ASAP.
