High severity · published Sep 30, 2026
CVE-2026-10739
Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
8.5
CVSS
0.1%
EPSS
No
On KEV
Description
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
SDP Client · Cato Networks
before 6.12.6 · source: vendor
In the news
VulnerabilityHigh
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
Sep 30, 2026·Quarkslab Blog
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10739
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10739
knowledge.catonetworks.com
https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126
More from SDP Client
8.8
CVE-2024-6978
Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users
8.8
CVE-2024-6975
Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file
8.8
CVE-2024-6973
Remote Code Execution in Cato Windows SDP client via crafted URLs
8.1
CVE-2025-3886
CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race Condition
7.8
CVE-2024-6974
Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade