Medium severity · published Sep 30, 2026
CVE-2026-10726
Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SDP Client · Cato Networks
before 6.12.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10726
knowledge.catonetworks.com
https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126
More from SDP Client
8.5
CVE-2026-10739
Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
8.1
CVE-2025-3886
CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race Condition
6.4
CVE-2026-12374
Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool