CVE-2026-19377: CWE-295 Improper Certificate Validation in Cato Networks Cato Client for Windows

CVE-2026-19377 describes an improper certificate validation vulnerability (CWE-295) in the tunnel handshake process of Cato Networks Cato Client for Windows. Due to this flaw, an attacker positioned as a man-in-the-middle can impersonate a legitimate Cato PoP server, enabling interception or modification of encrypted tunnel traffic. The vulnerability affects multiple versions of the client software prior to specified fixed versions. The CVSS 4.0 base score is 6.0, indicating medium severity, with attack vector as adjacent network and low complexity. No vendor patch or advisory details are provided in the source data.

An attacker exploiting this vulnerability could impersonate a Cato PoP server during the tunnel handshake, allowing interception or modification of tunnel traffic. This compromises the confidentiality and integrity of data transmitted through the tunnel. However, exploitation requires network adjacency and partial user interaction, and no known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Cato Networks communications for updates. Until a fix is available, consider limiting exposure to adjacent network attackers and verifying tunnel endpoints through alternative means if possible.