Improper certificate validation during the Cato Client tunnel handshake enables an attacker to perform a man-in-the-middle attack, impersonating a Cato Point of Presence server and intercepting or modifying all tunnel traffic. The underlying weakness is a failure to validate the server’s TLS certificate, a CWE‑295 flaw that allows a malicious server to present a forged certificate that the client accepts as legitimate.

The vulnerability affects Cato Networks’ Cato Client for Android, Linux, Windows, iOS, and macOS. All listed product versions are impacted; no specific minor version restrictions are provided in the advisory, so all deployed installations should be inspected for the latest published patch.

With a CVSS score of 6, the bug confers moderate risk. The EPSS score of less than 1% indicates a very low probability of exploitation at this time and the issue is not yet listed in the CISA KEV catalog. Nevertheless, the network-based attack surface is significant, as a hostile actor can position themselves between the client and the Cato PoP to carry out traffic tampering without detection.