CVE-2026-10726

Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

State: Published
Severity: 6.8 Medium
Published: Sep 30, 2026
Updated: Sep 30, 2026
Reserved: Jun 3, 2026

Description

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N	Cato

Weaknesses

CWE-295 Improper certificate validation
CWE-73 External control of file name or path

Affected Products

Product	Versions
SDP ClientCato Networks	before 6.12.6Affected

References

https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.