Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-19377

Improper certificate validation in Cato Client tunnel handshake

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Cato

Description

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cato Networks Cato Client for Windows

Default version status: unaffected

  • 0 to < 6.12.6affected

Cato Networks Cato Client for macOS

Default version status: unaffected

  • 0 to < 6.1.1affected

Cato Networks Cato Client for Linux

Default version status: unaffected

  • 0 to < 5.8.1affected

Cato Networks Cato Client for iOS

Default version status: unaffected

  • 0 to < 5.9affected

Cato Networks Cato Client for Android

Default version status: unaffected

  • 0 to < 5.6.2affected

References