Vulnerability · Published Sep 30, 2026 · Assigned by Cato
CVE-2026-10739Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
High 8.5
In plain English
A high-severity security flaw in SDP Client from Cato Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.1%top 97.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cato Networks | SDP Client | 0 – before 6.12.6 |
Weakness: CWE-23, CWE-59, CWE-73 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N