This article summarizes the features and enhancements of the Windows Client and the known limitations.
Admins and users can easily download the Client from the Client download portal without requiring authentication.
For more information about the requirements to implement Cato's remote access in your organization, see Preparing to Install the Cato Client.
Windows Client v6.16.2
During the week of Sep. 27, 2026, we will begin rolling out the Windows Client version 6.16.2. This version includes:
Updated OPSWAT OESIS to version 4.3.6494
Resolved Issues
ID | Description | Severity |
|---|---|---|
148227 | For Windows 11 devices, slow web browsing and DNS resolution delays on IPv6-enabled networks | High |
188252 | Client UI crashed on startup following a background upgrade due to locked browser files | High |
192641 | Publishing Client Connectivity or Device Posture policy updates caused unexpected user disconnections | High |
198964 | Windows Clients configured with the Managed by Admin upgrade policy sometimes automatically upgraded to a new version during Client reconnect or re-authentication | Critical |
200428 | Automatic background Client upgrades unexpectedly initiated a system reboot without warning | High |
200861 | Client UI appeared on screen during the first login after installation, ignoring the Start Minimized configuration | High |
202424 / 178795 | Windows VPN service terminated unexpectedly during system shutdown, generating Windows Error Reporting (WER) event logs | High |
205501 | The username wasn't showing on customized Cato block pages. | Critical |
206266 | When Always-On was enabled, admins couldn’t send remote management actions from the CMA (such as bypassing Always-On) or receive status updates from the Client | Medium |
207538 | Client upgrade window showed no download progress, causing upgrades to appear frozen | Medium |
Windows Client v6.12.6
During the week of Aug. 16, 2026, we will begin rolling out the Windows Client version 6.12.6. This version contains:
Improved certificate validation process for DTLS tunnel connections
Resolved Issues
ID | Description | Severity |
|---|---|---|
202424 | Fixed an issue where the Windows VPN service could crash during shutdown | High |
200699 | We fixed an issue that caused all internet access to be blocked after manually disconnecting the Windows Client when both Always-On and Trusted/Managed Network were configured. | Medium |
Windows Client v6.12
During the week of July 26, 2026, we will begin rolling out the Windows Client version 6.12. This version includes:
Additional Installation Parameters: The Windows MSI supports installation parameters that previously required setting registry keys, simplifying automated deployments.
Updated OPSWAT OESIS Framework: We updated the OPSWAT OESIS framework used by the Client to version 4.3.6344
Resolved Issues v6.12
ID | Description | Severity |
|---|---|---|
194104 | Fixed an issue that could cause the Client to become stuck during automatic upgrade | Medium |
195747 | Fixed an issue with Always-On reconnection after a bypass expired | Medium |
184142 | Fixed an issue where Digital Experience Monitoring (DEM) displayed incorrect Sent and Received packet counts for MTR probes | Medium |
Windows Client v6.8.3
During the week of June 14, 2026, we will begin rolling out the Windows Client version 6.8.3. This version includes:
Client Management now runs on a separate service to better support resiliency
To ensure this service runs correctly, add coresvc.exe to your security allowlist
Improved the process for how the Client identifies the optimal PoP to connect to
Support multiple NICs when using Intune MDM compliance checks for device posture
Resolved Issues v6.8.3
ID | Description | Severity |
|---|---|---|
181368 | Fixed an issue that caused the Experience Monitoring service to crash. | Critical |
179748 | Fixed an issue that caused devices with an EPP installed to fail an Anti-Malware device posture check | Critical |
167866 | Fixed an issue that prevented DNS resolution behind IPv6 networks | High |
176352 | Fixed an issue where DNS relay was not updated when a 3rd party VPN (for example, Global Protect) connects | High |
175865 | Fixed an issue that prevented end users from disabling Office Mode | Medium |
Windows Client v6.4
During the week of May 3, 2026, we will begin rolling out the Windows Client version 6.4. This version includes:
Resolved Issues v6.4
ID | Description | Severity |
|---|---|---|
173364 | Fixed an issue where the Client did not reconnect after a disconnection when Always-On is enabled. | High |
142788 | Fixed an issue that caused the Client to disconnect after switching networks on devices running Windows 11. | High |
169470 | Fixed an issue where users were prompted to reauthenticate after their session expired, even if Private Access was disabled. | Medium |
174502 | Fixed an issue where Device Posture updates were delayed and did not match the correct rules. | Medium |
174234 | Fixed an issue that prevented Experience Monitoring data being collected if the Client disconnected. | Medium |
Windows Client v6.2
During the week of March 22, 2026, we will begin rolling out the Windows Client version 6.2. This version includes:
Improved co-existence with 3rd party products
Resolved Issues v6.2
ID | Description | Severity |
|---|---|---|
168485 | Fixed an issue where, after an upgrade, the connection duration could be reported inaccurately with an inflated value. | Critical |
167355 | Improved reliability of User Awareness for users connected in Office Mode. | Critical |
167095 | Fixed an issue where, after successful authentication, the client could incorrectly return to the login screen. | Critical |
164574 | Fixed an issue where connectivity could be disrupted when transitioning from Wi-Fi to a wired network. | Critical |
163611 | Fixed an issue where Device Check validation did not correctly handle processes with multiple signature thumbprints. | Critical |
148414 | Fixed an issue where Always-On reconnection could fail after switching Windows session users. | High |
162709 | Fixed an issue where users were incorrectly prompted to authenticate with a Microsoft account as the first authentication step. | High |
Windows Client v6.0
During the week of February 22, 2026, we will begin rolling out the Windows Client version 6.0. This version includes:
Monitoring WiFi signal strength locally can indicate if a poor connection is identified (no license required)
Support for ARM architecture
Optimized the Cato Client for improved throughput
Resolved CVE-2025-15040 (vulnerability in the embedded Chromium browser)
Note: Automatic upgrade isn't available for some unsupported legacy Client versions. You need to uninstall the old version and then install the new one
Resolved Issues v6.0
ID | Description | Severity |
|---|---|---|
160357 | Fixed an issue that caused the Client to crash when Cisco AnyConnect was also running on the device | Critical |
159274 | Fixed a connectivity issue when connecting to a Trusted Network | High |
162961 | Fixed an issue that caused slow connection time | High |
162380 | Fixed an issue where the Client could not detect a captive portal | Medium |
160499 | Fixed an issue that caused authentication to fail with battery saving was enabled | Medium |
Known Limitation
The Running Processes Device posture check cannot be performed on several executables that block the Cato API. For example: n6agent.exe, MsSense.exe, QualysAgent.exe, and SentinelAgent.exe
Windows Client v5.21
During the week of December 14, 2025, we will begin rolling out the Windows Client version 5.21. This version includes:
Improvements to the look and feel of the Client tray icon
Resolved issues
Resolved Issues v5.21
ID | Description | Severity | Impacted Versions |
|---|---|---|---|
153314 | Fixed an issue that prevented manual PoP selection whenever the Connect on Boot checkbox was selected. | High | 5.18 and higher |
155308 | Fixed an issue that triggered an MFA prompt even when the user was already connected in Office Mode. | High | 5.8 and higher |
154819 | Fixed an issue where the client established a tunnel connection even while on a Trusted Network. | High | 5.18 and higher |
113963 | Fixed an issue where, under certain network conditions, office-based users were misclassified as external users, preventing Office Mode from engaging. | High | 5.12 and higher |
162961 | Fixed an issue where office networks could not be accurately identified | High | 5.12 and higher |
159274 | Fixed connectivity issues when the Client was connected to a trusted network | High | 5.12 and higher |
Windows Client v5.20
During the week of November 10, 2025, we will begin rolling out the Windows Client version 5.20. This version includes the following resolved issues:
Resolved Issues v5.20
ID | Description | Severity | Impacted Versions |
|---|---|---|---|
140490 | Fixed an issue to improve the accuracy of the HTTPS probe for DEM. | High | 5.15 and higher |
139438 | Fixed an issue in which unrelated IPs were allocated to our WinTUN device. | High | 5.15 and higher |
143363 | Fixed an issue where automatic reconnection for clients using Always-On failed after the machine resumed from sleep state. | High | 5.16 and higher |
Windows Client v5.18
During the week of October 19, 2025, we will begin rolling out the Windows Client version 5.18. This version includes the following resolved issues:
Resolved Issues v5.18
ID | Description | Severity | Impacted Versions |
|---|---|---|---|
111721 | Fixed an issue where Windows clients behind a Socket in Office Mode with Always-On intermittently failed to report the configured Device Posture Profile. | Critical | 5.12 and higher |
148024 | Fixed a stability issue causing occasional client crashes under specific runtime conditions. | Critical | 5.17 |
147493 | Fixed a reauthentication issue. | Critical | 5.16 and higher |
143835 | Fixed intermittent failures in device posture evaluation during the first sign-in. | Critical | 5.16 and higher |
143205 | Fixed a mismatch between Windows Defender ATP status and Client Connectivity Policy (CCP) evaluation when the client operated behind an office socket. | Critical | 5.17 |
143249 | Fixed an issue where the client could not be installed on 32-bit sytems running Windows 10. | High | 5.16 and higher |
146936 | Fixed an issue where the client failed to reauthenticate using an embedded browser. | High | 5.16 and higher |
142952 | Fixed an issue where the client was opening normally instead of minimized. | High |
Known Limitations for Windows Client v5.18 and Higher
This section lists known limitations that apply to all the Windows Clients version 5.0 and higher.
This Client version uses the 85.255.31.1 IP address as part of the infrastructure to support Single Sign-On (SSO)
Make sure that this IP address is NOT blocked by any third-party anti-malware software
For accounts that use Azure Conditional Access, please set the Browser Authentication to External Browser (Access > Client Access > Authentication) For more information about Browser Authentication, see Configuring the Authentication Policy for Cato Clients
Set Browser Authentication to internal In-Client Browser to authenticate to OneLogin
For OneLogin SSO, we recommend that you use the internal in-Client browser. When Browser Authentication is set to External Browser, if the browser window or tab is closed, the end-user can't authenticate to OneLogin
Windows 8.1 OS is only supported when all the newest Microsoft updates and patches are installed
Automatic Upgrade for Windows Servers is currently not supported
Automatic Upgrade for the Windows Client version 5.0 is disabled for hosts that use the Windows Server operating system and the Trusted Browsing feature on the Windows Server blocks the Client from authenticating
Solution: To use Windows Client v5.0 on a Windows Server you can use one of the following solutions and then install or upgrade the new Client version:
Allowlist the domains for your IdP for Trusted Browsing
Disable the Trusted Browsing feature
In some cases, for Windows devices with the Intel Killer Wireless NICs, after the Client connects to the network all traffic is blocked
Workaround: Disable the Killer Network Service on the Windows device, and then use the Cato Client to connect to the network
When using TAP virtual adapter, the MAC address of the Cato virtual adapter in the Client is randomly generated and isn’t guaranteed to be unique across the Clients in your network. Sometimes the MAC address isn’t shown for the virtual adapter.
When the MAC address is required, we recommend that you use the MAC address of the physical device instead of the Client virtual adapter.
If you change the default installation folder, during a Client upgrade or if you delete the Client, other files within the directory are deleted. If you add items to the default installation folder (C:\Program Files\Cato Networks\) they are deleted during a Client upgrade or if you delete the Client.
If IP routing is enabled on the device, the Client cannot authenticate.
Workaround: Disable IP routing on Windows. For more information, see IP Routing Prevents Windows Client Authentication.
For deployments with a third-party proxy, Internet Explorer is not supported as the default browser.
Configure a different default browser on the device.