What’s Vulnerable › Vulnerabilities

CVE-2026-19377: Improper certificate validation in Cato Client tunnel handshake

• Severity: medium (CVSS 6.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-295

Description

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Affected products

• Cato Networks Cato Client for Android: before 5.6.2 — fixed in 5.6.2
• Cato Networks Cato Client for iOS: before 5.9 — fixed in 5.9
• Cato Networks Cato Client for Linux: before 5.8.1 — fixed in 5.8.1
• Cato Networks Cato Client for macOS: before 6.1.1 — fixed in 6.1.1
• Cato Networks Cato Client for Windows: before 6.12.6 — fixed in 6.12.6

How to fix

Upgrade to a fixed version: Cato Networks Cato Client for Android 5.6.2; Cato Networks Cato Client for iOS 5.9; Cato Networks Cato Client for Linux 5.8.1; Cato Networks Cato Client for macOS 6.1.1; Cato Networks Cato Client for Windows 6.12.6. Check the vendor advisory for mitigations.

References

• https://knowledge.catonetworks.com/docs/security-vulnerability-cve-2026-19377-that-impacts-cato-client-versions

Get alerted when CVE-2026-19377 or the next vulnerability affects your stack