JumpCloud Remote Assist Vulnerability Can Expose Systems to Takeover

A vulnerability in JumpCloud Remote Assist for Windows could allow attackers to escalate privileges and potentially take over endpoints. The flaw, tracked as CVE-2025-34352 (CVSS 8.5), can be triggered during the removal or update of the JumpCloud Agent, with the uninstaller performing privileged actions on a directory the user controls.

The issue arises because the Remote Assist uninstaller executes privileged create, write, execute and delete actions in a user-writable %TEMP% subdirectory without validating the directory or resetting its ACLs. According to XM Cyber, attackers can rely on symbolic links and mount-point redirections to trick the uninstaller into acting on protected system files, enabling pre-creation of the target path and subsequent privileged operations. The vulnerability was addressed in JumpCloud Remote Assist for Windows version 0.317.0, and organisations are advised to update promptly.