Cato Networks SDP Client for Windows versions prior to 6.12.6 contains a flaw that allows a local user to supply a crafted security identifier (SID) over a local Inter‑Process Communication (IPC) named pipe. The client fails to properly validate this SID, which enables the user to delete arbitrary files on the system with the privileges of the SYSTEM account. This flaw falls under CWE‑23, CWE‑59, and CWE‑73, indicating problems with path traversal and improper file handling. An attacker who can run code locally on a machine with the client installed can therefore compromise system integrity and effectively gain full control by removing or altering protected files. Based on the description, the likely attack vector is local user exploitation.

Systems affected by this vulnerability are devices running the Cato Networks SDP Client for Windows with a version lower than 6.12.6. The vulnerability was discovered in the client’s IPC component that processes client‑supplied SIDs. The flaw is present in all builds before the 6.12.6 update. No other vendors or product lines are listed as affected.

The CVSS score of 8.5 reflects a high‑severity local privilege escalation. Because no EPSS score is available, the exact likelihood of exploitation cannot be quantified, but the weakness is straightforward to use for a local attacker. The vulnerability is not currently listed in CISA’s KEV, meaning no widespread exploitation has been documented yet, but the impact remains serious. An attacker with local access could delete critical files and gain full system control, so the risk is high for environments where the client is installed.