CVE-2026-10739 in SDP Client
Summary
by MITRE • 09/30/2026
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in Cato Networks Secure Desktop Platform (SDP) Client versions prior to 6.12.6 represents a critical privilege escalation flaw rooted in the mishandling of security identifiers within inter-process communication mechanisms on Microsoft Windows operating systems. This issue specifically affects local users who possess basic access rights, allowing them to execute actions that should be restricted to higher-privileged accounts or system processes. The core technical deficiency lies in how the client application validates a user-supplied Security Identifier (SID) when interacting with a locally named pipe designated for inter-process communication. In Windows environments, Named Pipes are commonly used for secure data exchange between processes running under different security contexts, often leveraging impersonation tokens to perform operations on behalf of the connecting client. The flaw arises because the application fails to rigorously validate that the SID provided by the local user actually corresponds to a context where deletion privileges are legitimately granted within the scope intended by the system administrator or software design.
From a technical perspective, this vulnerability is classified under CWE-284, which covers Improper Access Control, and more specifically aligns with CWE-732, involving incorrect permission assignment for critical objects. The attacker exploits the improper validation logic to trick the SDP Client into performing file system operations using the SYSTEM account's privileges rather than the limited permissions of the local user. By crafting a specific request over the local IPC named pipe and supplying an arbitrary SID that bypasses or manipulates the internal access control checks, the malicious actor can cause the application to delete files located in directories typically protected from standard users. This effectively allows for unauthorized modification of system state, configuration files, or other critical data residing on the host machine.
The operational impact of this vulnerability is significant due to the high privilege level involved. Since the deletion occurs with SYSTEM privileges, an attacker can remove essential operating system components, security software configurations, log files that might contain evidence of their activity, or specific application data required for business continuity. This capability undermines the integrity and availability aspects of the CIA triad. Furthermore, in a corporate environment where endpoint protection is managed centrally, deleting configuration files could disrupt policy enforcement mechanisms or disable logging agents, thereby facilitating further lateral movement or persistent access without detection. The ability to delete arbitrary files also poses a risk for denial-of-service attacks against specific applications dependent on those files being present and intact.
This behavior maps directly to the MITRE ATT&CK framework technique T1083, which describes File and Directory Discovery, although in this case it extends beyond discovery into active modification via T1485, Data Destruction. The exploitation vector is local, meaning physical or remote desktop access with a standard user account is sufficient to trigger the condition. There are no network-based attack vectors involved, as the named pipe communication occurs entirely within the localhost boundary. This localization makes traditional perimeter defenses ineffective against this specific threat, requiring host-based security controls and strict application whitelisting to mitigate potential abuse.
Mitigation strategies primarily involve upgrading the Cato Networks SDP Client to version 6.12.6 or later, where the vendor has addressed the improper validation of client-supplied SIDs. Until an upgrade is feasible, administrators should enforce least-privilege principles by restricting local user access to sensitive directories and monitoring for unusual named pipe activity using endpoint detection and response tools. Additionally, implementing strict file system permissions that prevent standard users from deleting files in critical paths can provide a layer of defense-in-depth against this specific exploitation technique. Regular auditing of IPC endpoints and ensuring that applications do not unnecessarily impersonate higher-privileged accounts unless strictly required by design will further reduce the attack surface for such privilege escalation vulnerabilities.