Check Point Harmony SASE Windows Client Vulnerability Enables Privilege Escalation
A critical privilege-escalation vulnerability, identified as CVE-2025-9142, has been discovered in Check Point’s Harmony SASE Windows client software, affecting versions prior to 12.2.
A critical privilege-escalation vulnerability, identified as CVE-2025-9142, has been discovered in Check Point’s Harmony SASE Windows client software, affecting versions prior to 12.2.
The vulnerability allows local attackers to write or delete files outside the intended certificate working directory, potentially leading to system-level compromise. The issue is found within the Service component of Perimeter81 software (Perimeter81.Service.exe), which operates with SYSTEM privileges. The root cause is insufficient validation of JWT (JSON Web Token) values during authentication.
The vulnerability is triggered when users initiate the Perimeter81 login flow through a URI handler. The JWT token is passed to the service via an IPC call but is processed without proper signature verification. A malicious actor can craft a perimeter81:// URL with a tampered JWT containing directory traversal sequences in the tenant ID field, bypassing authentication controls.
The exploitation chain involves two phases. Initially, the attacker registers a rogue authentication domain, which bypasses the client’s whitelist validation. JWT manipulation enables directory traversal, allowing the creation of folder structures outside the intended directory. The second phase involves symbolic link injection. The GenerateAndLoadCertificates() function writes client certificates to an attacker-controlled directory with SYSTEM privileges. By exploiting Windows Object Manager and RPC Control directory symlinks, attackers can redirect certificate writes to arbitrary system locations, such as C:\Windows\System32.
The issue is found within the Service component of Perimeter81 software (Perimeter81.Service.exe), which operates with SYSTEM privileges.
This vulnerability allows attackers to overwrite critical system files or inject malicious DLLs. Process monitoring reveals the service attempting to load missing DLLs from its working directory. By placing a malicious DLL at these locations, attackers can execute code when the Perimeter81 service restarts, escalating to SYSTEM-level access. The vulnerability is exacerbated by the service’s failure to enforce strict trust boundaries between user input and privileged operations.
Check Point was notified of the vulnerability on Thu, Mar 16, 2025, and released a fix in version 12.2 on Tue, Nov 18, 2025. The CVE was publicly disclosed on Wed, Jan 14, 2026.
Organizations using Harmony SASE should immediately upgrade to version 12.2 or later to mitigate the risk of local privilege escalation attacks. Additionally, restrict local administrative access and implement application whitelisting to prevent unauthorized DLL injection attacks.
Based on reporting by Cyber Security News.