JumpCloud Remote Assist for Windows Vulnerability Allows Privilege Escalation

A critical local privilege escalation vulnerability in JumpCloud Remote Assist for Windows allows low-privileged users to gain system-level access or crash machines.

Tracked as CVE-2025-34352, the flaw affects all versions before 0.317.0 and carries a High severity rating with a CVSS v4.0 score of 8.5.

JumpCloud, a widely deployed cloud-based Directory-as-a-Service platform used by over 180,000 organizations globally, has released patches that all affected organizations must prioritize immediately.

Vulnerability Details

The vulnerability resides in the Windows uninstaller component of JumpCloud Remote Assist.

During agent uninstallation, the process triggers the removal of Remote Assist while running as NT AUTHORITY\SYSTEM, the highest privilege level on Windows systems.

The uninstaller performs critical file operations within the user’s %TEMP% directory, a location entirely under the control of low-privileged users. This design flaw creates a direct attack surface.

The uninstaller searches for a file named Un_A.exe inside temporary directories (such as %TEMP%~nsuA.tmp) and performs operations including deletion, creation, writing, and execution of this file while maintaining system privileges.

Because the path and filename are predictable and located in a user-writable directory, attackers can exploit this behavior using mount points and symbolic link techniques to redirect privileged file operations to sensitive system targets.

Successful exploitation enables attackers to pursue two primary attack paths. First, attackers can execute arbitrary writes to critical system drivers, triggering repeated Blue Screen of Death (BSOD) errors that cause Denial-of-Service conditions.

Second, attackers can exploit arbitrary file deletion through race conditions and Windows Installer techniques to obtain a full SYSTEM shell with persistent endpoint control.

Any user with an account on a vulnerable Windows system where JumpCloud Agent and Remote Assist are installed can weaponize the legitimate security agent for malicious purposes.

Successful exploitation provides complete machine control, enabling malware installation, data exfiltration, and lateral movement within corporate networks.

The root cause stems from a classic but severe design flaw: a highly privileged process performing sensitive file operations in user-controlled, writable directories without proper protections.

This pattern has been recognized as dangerous on Windows systems for years, yet it persists in modern agent implementations.

JumpCloud has released patches addressing this vulnerability. All organizations using JumpCloud Remote Assist for Windows must immediately update to version 0.317.0 or later.

Security teams should verify that all managed Windows devices have received updates, review endpoint hardening policies, and audit other privileged processes to ensure they do not perform file operations in %TEMP% or similar user-writable locations without strict access controls.

Given the straightforward nature of exploitation and the fundamental trust placed in endpoint management tools, prompt patching is essential to prevent unauthorized system access and maintain security posture across managed environments.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates