CVE-2026-10726

UNKNOWN

Description

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

Timeline

Published:September 30th, 2026 12:17 PM

Last modified:September 30th, 2026 7:38 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-73 CWE-295

References & Reports

Advisories, patches, and third-party reports

https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126

Source: NIST NVD · Data may lag official sources by up to one minute