Cato Networks SDP Client for Windows: Local privilege escalation via IPC pipe
Summary
The Cato Networks SDP Client for Windows before 6.12.6 lets a local user with valid access to the device delete arbitrary files with SYSTEM privileges. The flaw lies in improper validation of a client-supplied SID over a local IPC named pipe. The attack requires local access and low privileges, and no user interaction, and it is not remotely exploitable. A public technical write-up exists, but CISA reports no known active exploitation.
Affected
- Cato Networks SDP Client for Windows, versions before 6.12.6
- Windows Client versions lower than 6.12.6 per vendor advisory
Fixed in
- Version 6.12.6 and later (vendor advisory)
Workaround
- None documented by the vendor. Upgrading to 6.12.6 or later is the only vendor remediation.
- Interim measures (not vendor guidance): restrict local logons on shared or kiosk-style machines and keep endpoint protection active.
Exploitation
- Local attack only; requires a local account or existing code execution as a standard user.
- Public proof of concept: a technical write-up by Quarkslab (1 October 2026) describes the escalation chain. Conflicting reports exist.
- Not listed in the CISA KEV catalog; no confirmed active exploitation.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all Windows endpoints with the Cato Client and check versions in the Cato Management Application (Access Overview).
- Upgrade all clients to version 6.12.6 or later, prioritising shared devices and devices of high-risk users.
- Confirm with Cato whether older or unsupported client builds remain unpatched.
- Monitor for a KEV listing and for signs of local privilege escalation on endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cato advisory: CVE-2026-10726 & CVE-2026-10739 impacts Windows Client versions lower than 6.12.6 knowledge.catonetworks.com
- Quarkslab technical write-up blog.quarkslab.com
- Strix AI: CVE-2026-10739 www.strix.ai
- TheHackerWire: CVE-2026-10739 www.thehackerwire.com
- CVE-2026-10726 companion issue (cvefeed.io) cvefeed.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:44.
Original description (NVD)
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.