---
id: CVE-2026-19377
title: >-
  Improper certificate validation in the tunnel handshake in Cato Client allows
  a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP)
  server and intercept or modify tunnel traffic.
summary: >-
  Improper certificate validation in the tunnel handshake in Cato Client allows
  a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP)
  server and intercept or modify tunnel traffic.
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-295
vendor: Cato Networks
product: Cato Client for Windows
affected:
  - cato_client_for_windows < 6.12.6
  - cato_client_for_macos < 6.1.1
  - cato_client_for_linux < 5.8.1
  - cato_client_for_ios < 5.9
  - cato_client_for_android < 5.6.2
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:17:59.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19377'
references:
  - url: >-
      https://knowledge.catonetworks.com/docs/security-vulnerability-cve-2026-19377-that-impacts-cato-client-versions
    label: 2505284f-8ffb-486c-bf60-e19c1097a90b
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-10-15T07:57:27.846Z'
---

## Overview

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.