CVE-2026-10726: Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cato Windows SDP Clientto a version that resolves this vulnerability.Fixed in 6.12.6
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged local user can exploit it. Exploitation requires local access to a system running the affected Windows client service.
What component and privilege boundary are involved?
The affected Windows service runs as Local System. The flaw can cause that service to read and disclose arbitrary local files, crossing from a low-privileged user context to files accessible to Local System.
Which versions should be remediated?
Cato Windows SDP Client versions earlier than 6.12.6 are affected. Update to version 6.12.6 or later.