What’s Vulnerable › Vulnerabilities
CVE-2026-10726: Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation
- Severity: medium (CVSS 6.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-30 · updated 2026-09-30
- Weakness: CWE-73
Description
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.
Affected products
- Cato Networks SDP Client: before 6.12.6 — fixed in 6.12.6
How to fix
Upgrade to a fixed version: Cato Networks SDP Client 6.12.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-10726 or the next vulnerability affects your stack