CVE-2026-10726
Received Received - Intake

Arbitrary File Disclosure in Cato Windows SDP Client

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cato

Description
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-10726
EUVD
EUVD-2026-89780

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cato windows_sdp_client to 6.12.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-10726 is an arbitrary file disclosure vulnerability in the Cato Windows SDP Client before version 6.12.6. A low-privileged local user can exploit improper file path validation and missing TLS certificate enforcement to cause the Windows service, running as Local System, to read and disclose arbitrary local files.

Impact Analysis

This vulnerability allows a low-privileged local attacker to access sensitive files on the system by exploiting the Cato Windows service. Since the service runs as Local System, it could expose confidential data stored on the machine.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict data protection and access controls. Unauthorized file disclosure may result in legal penalties or data breach notifications.

Mitigation Strategies

Update the Cato Windows SDP Client to version 6.12.6 or later to address the arbitrary file disclosure vulnerability caused by improper file path validation and missing TLS certificate enforcement.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10726. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart