CVE-2026-19377
Improper certificate validation in Cato Client tunnel handshake
Cato Networks Cato Client for Windows
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.08%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.12.6Cato Client for WindowsCVE List
- 6.1.1Cato Client for macOSCVE List
- 5.8.1Cato Client for LinuxCVE List
- 5.9Cato Client for iOSCVE List
- 5.6.2Cato Client for AndroidCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
Text from CVE List
Affected versions 5
- Cato Client for Windowsaffected: all versions before 6.12.6CVE List
- Cato Client for macOSaffected: all versions before 6.1.1CVE List
- Cato Client for Linuxaffected: all versions before 5.8.1CVE List
- Cato Client for iOSaffected: all versions before 5.9CVE List
- Cato Client for Androidaffected: all versions before 5.6.2CVE List