JUMPSHOT: XM CYBER UNCOVERS CRITICAL LOCAL PRIVILEGE ESCALATION (CVE-2025-34352) IN JUMPCLOUD AGENT

Summary from the TLDR InfoSec newsletter

A critical flaw was found in the JumpCloud Remote Assist for Windows agent that lets any low-privileged user on a machine gain full SYSTEM-level control or crash the system entirely. The issue stems from the agent's uninstaller performing file creation, deletion, and execution in the user's %TEMP% directory, which an attacker can redirect using symbolic links and mount points to target protected system files. This enables both denial-of-service via driver corruption and full local privilege escalation through a race condition involving Windows Installer files, making rapid patching to version 0.317.0 or later essential for organizations using JumpCloud-managed Windows endpoints.