CVE-2026-19377: Cato Client for Windows 0 to before 6.12.6; +4 more affected products

Affected technology

Cato Client for Windows · 0 to before 6.12.6
Cato Networks

Cato Client for macOS · 0 to before 6.1.1
Cato Networks

Cato Client for Linux · 0 to before 5.8.1
Cato Networks

Cato Client for iOS · 0 to before 5.9
Cato Networks

Cato Client for Android · 0 to before 5.6.2
Cato Networks

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

A man-in-the-middle attacker can impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic. Source advisory’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.