CVE-2026-19377 PUBLISHED

Improper certificate validation in Cato Client tunnel handshake

Assigner: Cato
Reserved: 09.08.2026 Published: 15.10.2026 Updated: 15.10.2026

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor Cato Networks
Product Cato Client for Windows
Versions Default: unaffected
  • affected from 0 to 6.12.6 (excl.)
Vendor Cato Networks
Product Cato Client for macOS
Versions Default: unaffected
  • affected from 0 to 6.1.1 (excl.)
Vendor Cato Networks
Product Cato Client for Linux
Versions Default: unaffected
  • affected from 0 to 5.8.1 (excl.)
Vendor Cato Networks
Product Cato Client for iOS
Versions Default: unaffected
  • affected from 0 to 5.9 (excl.)
Vendor Cato Networks
Product Cato Client for Android
Versions Default: unaffected
  • affected from 0 to 5.6.2 (excl.)

References

Problem Types

  • CWE-295 Improper Certificate Validation CWE

Impacts

  • CAPEC-94 Adversary in the Middle (AiTM)