CVE-2026-19377
CVE-2026-19377 · Improper certificate validation in Cato Client tunnel handshake
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
CVSS 6.0 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
cato client for windows
- Versions
- ≥ 0, < 6.12.6: Affected (custom)
Update to 6.12.6
cato client for macos
- Versions
- ≥ 0, < 6.1.1: Affected (custom)
Update to 6.1.1
cato client for linux
- Versions
- ≥ 0, < 5.8.1: Affected (custom)
Update to 5.8.1
cato client for ios
- Versions
- ≥ 0, < 5.9: Affected (custom)
Update to 5.9
cato client for android
- Versions
- ≥ 0, < 5.6.2: Affected (custom)
Update to 5.6.2