CVE-2026-10726CWE-295CWE-73

CVE-2026-10726

published September 30, 2026

CVSS
6.8
EPSS
0%
Percentile
0.0
In the wild
Unconfirmed
What it is

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

The record
Technical detail
CVSS
6.8 · NONE
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00063 · 0.0th percentile
Weaknesses
CWE-295 · Improper Certificate Validation; CWE-73 · External Control of File Name or Path
Published
2026-09-30T16:17Z
References (1)
https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126 · 2505284f-8ffb-486c-bf60-e19c1097a90b
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 11:38Z
    Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation
    cvelistv5