Cato Networks SDP Client vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Cato Networks SDP Client: 3 record(s), with affected versions and fixes.

CVE-2026-10739 High · 8.5 CWE-23 Sep 30, 2026

Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

CVE-2026-10726 Medium · 6.8 CWE-73 Sep 30, 2026

Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

CVE-2026-12374 Medium · 6.4 CWE-295 Jul 1, 2026

Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool

Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.