Cato SDP Client CVE-2026-10726

Requires an existing low-privileged local account on a Windows host running the Cato Windows SDP Client at a version below 6.12.6, where the client's Windows service runs as Local System. The attacker exploits improper file-path validation (compounded by missing TLS certificate enforcement, CWE-295) to make that SYSTEM-level service read files the attacker cannot otherwise access. Limiting factors: the attack vector is local (no remote/network exploitation), the attacker must already have a foothold on the machine, and only vulnerable versions before 6.12.6 are affected; upgrading to 6.12.6 remediates it. Impact is confidentiality-only (arbitrary file read) with no integrity or availability effect.

The CVSS 4.0 base score is 6.8 (Medium), driven by a local attack vector (AV:L), low privileges (PR:L), and high confidentiality impact (VC:H) with a limited subsequent-system confidentiality effect (SC:L) reflecting that a low-privileged user coerces a Local System service into reading files beyond the user's own authorization. There is no integrity or availability impact. Exploitation status: no public exploit identified at time of analysis - the sole reference is Cato's own knowledge-base advisory, with no EPSS score, no CISA KEV listing, no SSVC decision data, and no POC provided in the input. This is a genuine local privilege-boundary/information-disclosure issue rather than a remotely-wormable emergency: the local-only vector and requirement for an existing low-privileged foothold sharply limit blast radius, so it is a moderate-priority patch item for Cato-managed Windows endpoints rather than an urgent internet-facing exposure. One nuance to verify with the vendor: the description cites 'missing TLS certificate enforcement' (CWE-295), which typically implies a network/man-in-the-middle element, yet the CVSS vector is AV:L - the local vector suggests the primary exploited weakness is improper file-path validation, with the TLS gap a secondary contributing factor; confirm the exact exploitation path with Cato.

An attacker with an ordinary (low-privileged) local account on a Windows host running the Cato SDP Client abuses the client's Windows service, which runs as Local System, by supplying a crafted file path that the service fails to validate. The service then reads a protected file the user could not otherwise access (e.g., SYSTEM-only or other users' files) and discloses its contents back to the attacker. No public exploit code is identified at time of analysis.