Cato Networks has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 6.8 (medium). Most affected products: SDP Client (2), Cato Client for Windows (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-10739High· 8.5Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.47CVE-2026-10726Medium· 6.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability37CVE-2026-19377Medium· 6.0Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.33
Cato Networks vulnerabilities
CVEs affecting Cato Networks, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-19377Medium· 6.0Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
CVE-2026-10726Medium· 6.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to impr…
CVE-2026-10739High· 8.5Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.