CVE-2026-10726
Awaiting Analysis Awaiting Analysis - Queue

Arbitrary File Disclosure in Cato Windows SDP Client

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cato

Description
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-19
AI Q&A
2026-09-30
EPSS Evaluated
2026-10-18
NVD
CVE-2026-10726
EUVD
EUVD-2026-89780

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cato windows_sdp_client to 6.12.6 (exc)
cato_networks sdp_client to 6.12.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-10726 is an arbitrary file disclosure vulnerability in the Cato Windows SDP Client before version 6.12.6. A low-privileged local user can exploit improper file path validation and missing TLS certificate enforcement to cause the Windows service, running as Local System, to read and disclose arbitrary local files.

Detection Guidance

To detect this vulnerability, check the installed version of the Cato Windows SDP Client. If the version is lower than 6.12.6, the system is vulnerable. Use the following command in Command Prompt: wmic product where "name like 'Cato Windows SDP Client'" get version. Compare the output with 6.12.6.

Impact Analysis

This vulnerability allows a low-privileged local attacker to access sensitive files on the system by exploiting the Cato Windows service. Since the service runs as Local System, it could expose confidential data stored on the machine.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data protection and access controls. Unauthorized file disclosure may result in legal penalties or data breach notifications.

Mitigation Strategies

Update the Cato Windows SDP Client to version 6.12.6 or later to address the arbitrary file disclosure vulnerability caused by improper file path validation and missing TLS certificate enforcement.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart