Companies like Dropbox, Atlassian, Olipop, and Mozilla continue to offer remote work to employees, despite the push to return to the office.
An "authorized attacker" could exploit this weakness to gain elevated privileges, potentially reaching SYSTEM-level access.