Improper Certificate Validation in Cato Client Affects Cato Networks
CVE-2026-19377

6MEDIUM

Key Information:

Vendor: Cato Networks
Status: Cato Client For Windows; Cato Client For Mac OS; Cato Client For Linux; Cato Client For iOS
Vendor: CVE Published:; 15 October 2026

🔔 Create Cato Networks Vulnerability Alert

What is CVE-2026-19377?

The Cato Client suffers from an improper certificate validation flaw during the tunnel handshake process. This vulnerability enables a man-in-the-middle attacker to impersonate a legitimate Cato Point of Presence (PoP) server, potentially allowing them to intercept or modify sensitive tunnel traffic. Users are urged to update their Cato Client installations to the latest version to mitigate the risk associated with this security issue.

Affected Version(s)

Cato Client for Android Android 0 < 5.6.2

Cato Client for iOS iOS 0 < 5.9

Cato Client for Linux Linux 0 < 5.8.1

References

https://knowledge.catonetworks.com/docs/security-vulnerab...

vendor-advisory

CVSS V4

Score:

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

High

Availability:

None

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 15, 2026
Vulnerability Reserved
Aug 9, 2026

CVE-2026-19377 Data

JSON