Cato recently identified a security vulnerability (CVE 2026-19377) that impacts Cato Clients lower than the versions listed below. This CVE is related to improper certificate validation in the Cato Client tunnel handshake.
Make sure that you update to the following Client versions (or higher):
Windows Client v6.12.6
macOS Client v6.1.1
Linux Client v5.8.1
iOS Client v5.9
Android Client v5.6.2
The new Cato Client versions (and higher) include a security patch that fully remediates this vulnerability.
We strongly recommend that you ensure all Clients are upgraded to the new Client versions to protect against the vulnerability. You can download the latest versions as follows:
Windows, macOS, and Linux Clients from the Client Rollout page in the Cato Management Application (open the page)
iOS Client from the App Store
Android Client from the Google Play Store
What Changes Do I Need to Make?
Use the Access Overview Dashboard to identify users who have vulnerable Client versions for each OS, and make sure that they upgrade to the new versions to receive the most recent security patches and enhancements.
For example, go to the Access Methods section and filter for Cato Client on Windows for the Top Client Version.
We recommend that you use the Cato upgrade service to automatically upgrade Clients to the newest version.
What is the Impact on the Account?
If you don’t upgrade to these new Client versions (or higher), devices running older Client versions are vulnerable to malicious attacks that use CVE 2026-19377. These are the minimum Client versions that contain the patch for CVE 2026-19377:
Windows Client v6.12.6
macOS Client v6.1.1
Linux Client v5.8.1
iOS Client v5.9
Android Client v5.6.2
Who Do I Talk to If I Have Questions?
Please use the Cato Ask AI agent in the CMA for questions related to the Access Overview Dashboard and upgrading Cato Clients.
Take me to the CMA AI Workspace.