CVE-2026-10739

Cato VPN Client split-tunnel path traversal and privilege escalation

Cato Networks SDP Client for Windows before 6.12.6 trusted a client-supplied SID when constructing split-tunnel file paths. Path traversal over the named pipe and symlink redirection allowed privileged cleanup to delete arbitrary targets as SYSTEM, enabling privilege escalation through Windows Installer rollback. Version 6.12.6 contains the fix.

Vendor

Cato Networks

Product

SDP Client for Windows

Component

Split-tunnel upload / winvpnclient.cli.exe / cato-VPN named pipe

Disclosure

Sep 30, 2026

Bug class

CWE-23, CWE-59, CWE-73, path traversal, symlink following

Severity

High (CVSS 4.0: 8.5)