CVE-2026-10726 — Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

CVE-2026-10726

Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation PUBLISHED

Description (CNA)

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

Affected (CNA)

Vendor / product	Versions
Cato Networks / SDP Client	affected 0 before 6.12.6

CWE

CWE-295, CWE-73

References

https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.