Cato Client EUVD-2026-101881

Exploitation requires the attacker to hold a man-in-the-middle position on the same adjacent/local network segment as the victim endpoint (AV:A) and to intercept the Cato Client's tunnel handshake at connection time, when it establishes the tunnel to a Cato PoP server (the AT:P attack requirement reflects this positioning prerequisite). The flaw is the client's improper validation of the PoP server certificate (CWE-295), so no credentials (PR:N) and no user interaction (UI:N) are needed once the MITM position exists. LIMITING FACTORS: the attack is NOT internet-remote - it cannot be launched from an arbitrary location; the attacker must already control or occupy the local network path (e.g., rogue access point, ARP spoofing, malicious hotspot), which substantially narrows realistic exploitation to untrusted-network scenarios rather than default corporate deployments.

This is a moderate-severity integrity/confidentiality issue, not a high-priority emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N, score 6.0) tells a consistent story: exploitation requires an ADJACENT network position AND a specific attack requirement (AT:P) - namely that the attacker already occupy a man-in-the-middle vantage point between the Cato Client and the PoP. That precondition is the single biggest risk limiter; it is not remotely exploitable across the internet (AV:A, not AV:N). Impact is weighted toward integrity (VI:H - traffic can be modified) with only limited confidentiality exposure (VC:L) and no availability impact (VA:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The input tag 'Information Disclosure' only partially captures the issue - the CVSS and description emphasize traffic MODIFICATION (integrity) at least as much as interception. Net: a real but conditional flaw whose practical risk hinges entirely on an attacker achieving a MITM position on the local/adjacent network; prioritize patching for high-mobility endpoints (public Wi-Fi, untrusted networks) over fixed corporate LANs.

An attacker on the same adjacent network as a victim (e.g., a shared or rogue Wi-Fi network) positions themselves between the Cato Client and a legitimate Cato PoP. Because the client fails to properly validate the PoP's certificate during the tunnel handshake, the attacker presents a fraudulent certificate, impersonates the PoP, and transparently intercepts or alters tunnel traffic. No public exploit code was identified in the provided data, and success requires the attacker to already hold a man-in-the-middle position.