CVE-2026-10726

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

CVSS

No CVSS.

References

Link	Resource
https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126

Configurations

No configuration.

History

30 Sep 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 12:17

Updated : 2026-09-30 19:38

NVD link : CVE-2026-10726

Mitre link : CVE-2026-10726

CVE.ORG link : CVE-2026-10726

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-10726", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10726", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T14:27:19.974513Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "2505284f-8ffb-486c-bf60-e19c1097a90b", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "2505284f-8ffb-486c-bf60-e19c1097a90b", "affectedData": [{"vendor": "Cato Networks", "product": "SDP Client", "versions": [{"status": "affected", "version": "0", "lessThan": "6.12.6", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-09-30T12:17:12.810", "references": [{"url": "https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126", "source": "2505284f-8ffb-486c-bf60-e19c1097a90b"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "2505284f-8ffb-486c-bf60-e19c1097a90b", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement."}], "lastModified": "2026-09-30T19:38:27.293", "sourceIdentifier": "2505284f-8ffb-486c-bf60-e19c1097a90b"}

CVE-2026-10726

JSON object

Attach tags to CVE-2026-10726

Attach tags to `CVE-2026-10726`