CVE-2026-19377 — Improper certificate validation in Cato Client tunnel handshake

CVE-2026-19377

Improper certificate validation in Cato Client tunnel handshake PUBLISHED

Description (CNA)

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Affected (CNA)

Vendor / product	Versions
Cato Networks / Cato Client for Windows	affected 0 before 6.12.6
Cato Networks / Cato Client for macOS	affected 0 before 6.1.1
Cato Networks / Cato Client for Linux	affected 0 before 5.8.1
Cato Networks / Cato Client for iOS	affected 0 before 5.9
Cato Networks / Cato Client for Android	affected 0 before 5.6.2

CWE

CWE-295

References

https://knowledge.catonetworks.com/docs/security-vulnerability-cve-2026-19377-that-impacts-cato-client-versions

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.