CVE-2026-10739CWE-23CWE-59CWE-73

CVE-2026-10739

published September 30, 2026

CVSS
8.5
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00120 · 1.7th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-73 · External Control of File Name or Path
Published
2026-09-30T16:17Z
References (1)
https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126 · 2505284f-8ffb-486c-bf60-e19c1097a90b
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 11:37Z
    Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
    cvelistv5