{
  "cveId": "CVE-2026-10726",
  "url": "https://patchblox.com/security/cve/CVE-2026-10726",
  "summary": "CVE-2026-10726 is fixed in Cato Client on 1 platform by Cato Client 6.12.6.9050 (version 6.12.6.9050), released August 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation",
  "description": "Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.",
  "published": "2026-09-30T12:17:12Z",
  "severity": "",
  "cvss": 6.8,
  "cwe": "CWE-295: Improper certificate validation",
  "epss": 0.00064,
  "epssPercentile": 0.00011,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-10726",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Cato Client",
      "fixedVersion": "6.12.6.9050",
      "fix": "Cato Client 6.12.6.9050",
      "url": "https://patchblox.com/security/fix/windows-app/catonetworks.catoclient-6.12.6.9050",
      "released": "2026-08-16T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}