New Features & Enhancements
New Device On-ramping to Cato Cloud with Site Web Proxy (Explicit Proxy): Extend Secure Web Gateway (SWG) protection to devices that route Internet traffic via a PAC file and cannot install the Client (e.g., agentless and unmanaged devices).
Support enterprise environments using an explicit proxy for web traffic forwarding
Enable identity-aware security policies with Kerberos authentication
Simplified AI Security Onboarding with AI Only Mode for Windows: Use AI Only mode in the Client Split Tunnel policy to route selected AI application traffic to the Cato Cloud for AI Security inspection and enforcement.
Covers AI interactions from browsers and native desktop apps
Supports AI applications such as ChatGPT, Claude, and Microsoft Copilot
Available with Windows Client v6.4 and higher
AI Security for Users license required
Upcoming Navigation Changes for AI Security: Starting October 18, 2026, the AI Security navigation menu in the Cato Management Application (CMA) is changing to make monitoring and configuration workflows easier to find.
Monitoring groups overview pages, interactions, findings, and inventory pages for users, applications, agents, tools, MCP servers, and skills
Related session pages are consolidated under Interactions with tabs for user, coding agent, and homegrown agent sessions
Configuration groups engine settings, policies, integrations, data sovereignty, Browser Plugin, Scout, Guards, and outposts
iOS Client v5.9.1: In the week of Oct. 11, 2026, iOS Client version 5.9.1 will be available for download from the App Store. This version includes bug fixes, security enhancements, and stability improvements.
Poor Wi-Fi Client Notification Support for macOS: The macOS Client detects poor Wi-Fi signal strength on a device. This helps users identify Wi-Fi issues that may affect their connection.
Supported from macOS Client v6.1.1
Previously only supported on the Windows Client
BGP for IPsec Active/Active Sites: We added support for BGP peering for IPsec sites configured with multiple active tunnels.
Streamlined XOps Investigation with the Unified Stories page: We merged the XOps Overview and Stories Workbench pages into the Stories page in the CMA. This lets you easily analyze stories in one place.
XOps license required
Manage Different CCP Changes in Separate Revisions: Admins can maintain multiple parallel Client Connectivity Policy (CCP) revisions, allowing different policy changes to be developed independently. This enables smaller updates to be published while other changes remain in progress.
Switch between published and unpublished revisions
Streamlined RMA Process: We improved the process for hardware RMA requests for your account. Submit requests directly from Support tickets, and the information is sent to the Cato logistics team, who will then follow up by email.
Select RMA as the Category when opening a ticket
Refresh Connection Action for Clients: Restart a user's Client connection from the Actions menu on the Client Management page, making it a quick first troubleshooting step without requiring any input from the user.
Gradual Rollout of Socket v27 Minor Version: We are starting to gradually roll out Socket v27.0.24538, including enhancements and bug fixes.
Always-On Enforcement Status in Client Management: See whether Always-On is active or suspended on each endpoint, and why, as a filterable column on the Client Management page.
Suspension reasons cover admin-code bypass, user bypass, remote-action bypass, trusted network, and fail-open
Supported on Windows Client v6.16.2 and higher
Limit Client Upgrade Snoozes: Cap how many times users can postpone a Client upgrade in User Managed mode, keeping devices current while users still choose when to upgrade (show me the Upgrade Policy page).
Supported on Windows Clients v6.16.2 and higher
Updated Cato Terraform to v1.1.0: We uploaded version 1.1.0 of the Terraform module.
Added Cloud Router configuration for supported GCP vSocket HA sites through cato_socket_site
Enhanced FQDN Options for IPsec Sites: To eliminate the need to manage static IP addresses and enable geolocation-based PoP selection for improved routing and availability, IPsec sites in Bidirectional mode can now use FQDN authentication identifiers.
Previously supported only for IPsec sites using Responder Only mode
CMA Enhancement - Advanced Security License Renamed to App & Data Security: The Advanced Security Package, a Premium Security add-on license, is renamed to App & Data Security. Applies to the Bursting and Enforcement license models.
In Case You Missed It
Control User Access to AI Applications: Did you know that you can guide users to approved AI applications and reduce risky AI usage with the AI Security User Access Policy?
Define granular access rules for users with the AI Security Browser Plugin
AI Security for Users license required
Security Updates
Apps Catalog
View more details about apps in the Apps Catalog.
New Apps: 1 new apps
Zo Computer
Enhanced Apps:
ScreenConnect Client
Signature Updated
Windows Update
Added domain cdp-f-tlu-net.trafficmanager.net
Socket Apps
Socket v25
Added 1 apps
Amazon S3 supported for domains and IP based
Modified 2 apps
ScreenConnect Client - Signature updated
Windows Update - Modified app domains
IPS Signatures
View more details about the IPS signatures and protections in the Threats Catalog.
Atomic MacOS Infostealer (new)
CVE-2026-70585 (new)
CVE-2026-69852 (new)
CVE-2026-69676 (new)
CVE-2026-69623 (new)
CVE-2026-62911 (new)
CVE-2026-81578 (new)
CVE-2026-77806 (new)
CVE-2026-21962 (new)
CVE-2026-32475 (new)
CVE-2026-25895 (new)
CVE-2026-41042 (new)
CVE-2026-64849 (new)
CVE-2026-10768 (new)
CVE-2026-9506 (new)
CVE-2026-62893 (new)
CVE-2026-13147 (new)
CVE-2025-71324 (new)
CVE-2026-53576 (new)
CVE-2026-55450 (new)
CVE-2025-71334 (new)
Generic HTTP Request Smuggling (new)
CVE-2021-40323 (new)
Generated Domain To Low Reputation Destination (new)
DNS Generated Domain To Low Reputation Destination (new)
Application Control Policy
Granular App: Microsoft Copilot - Create AI Agent (New)
DLP
Support JT file type
Device Inventory
These are the updates to the Device Inventory detection engine:
IoT
IP Camera
Axis Communications (New)
IQinVision (New)
Hanwha (Enhancement)
Improved classification rule
Metadata Updated
IoT Gateway
Dragino Technology (New)
OT
AC Drive
Rockwell Automation (New)
Schneider Electric Altivar 930 ATV930D11S6X (New)
Siemens (New)
HMI Panel
Pro-face (New)
Siemens (New)
Industrial Network Equipment
Control Technology (New)
Rockwell Automation (New)
OT Gateway
Schneider Electric Acti9 Smartlink SI B A9XMZA08 (New)
PLC
Rockwell Automation (New)
Schneider Electric Modicon M221 TM221CE16R (New)
Siemens (New)
Power Meter
Siemens SENTRON PAC4200 PAC4200 (New)
Remote IO
Siemens (New)
Servo Drive
Siemens (New)
Vision Sensor
Cognex (New)
Networking
UPS
APC (Enhancement)
Improved classification rule
Metadata Updated
Server
Hypervisor
Hypervisor (Enhancement)
New signals added
Application Control Via API and Data Protection API Integrations
The enhancements were made for Application Control Via API.
Azure AD | Revoke Session (New)
Revoke Session is now generally available: Allows Cato Client sessions to be revoked automatically when a user's sessions are revoked in Microsoft Entra ID
Microsoft Defender for Endpoint/CloudApps/Office | XDR (Enhancement)
Improved retrieval of Defender incidents so alerts are correctly linked to their incidents
Salesforce | Activity (Enhancement)
File-related events nowi nclude more consistently the file's name, size and type
Actions are now classified more accurately (e.g. report exports and file downloads are now reported as downloads)
Improved general performence and resilience of connector
Okta | Third Party Apps (Enhancement)
Improved handling of applications that can't be matched to a known app, which are now shown under their original Okta name
Azure AD, GitHub, Outlook, SharePoint, Google Drive | Anomalies (Enhancement)
Alert titles now consistently carry the apllication name as a prefix
Google Drive | Anomalies (Enhancement)
Modified name from User from Different Domain Added to Google Shared Drive to Google Shared Drive External Member Added
ServiceNow | Anomalies (New)
21 new detections for weakened ServiceNow security properties (e.g. MFA enforcement disabled, API authentication requirement removed, CSRF token protection disabled)
ServiceNow | Third Party Apps (New)
Discovery of third-party apps and OAuth grants in ServiceNow is now generally available