WatchGuard Mobile VPN with SSL Windows Client Local Privilege Escalation
Priority LOW 33CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed Mobile VPN with SSL Client (WatchGuard): 2026.2.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Mobile VPN with SSL Client | 12.0 to before 2026.2.1 | 2026.2.1 | Patch available | CNA |
- Mobile VPN with SSL Client VendorWatchGuard Affected 12.0 to before 2026.2.1 Fixed in 2026.2.1 Patch available CNA
CPE configurations NVD · 42
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:* | before 2026.2.1 | Vulnerable | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.0.0 to before 12.12.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:* Versions before 2026.2.1 Vulnerable ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.12.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Show 32 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 2025.1 to before 2026.2.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.5 – 12.5.18 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 2025.1 to before 2026.2.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.5 – 12.5.18 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Remediation
- Fix · CNA Mobile VPN with SSL Client (WatchGuard) Fixed in 2026.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13079
- 2026-10-03 Alias added: GHSA-qgpj-9w2h-pcv3
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2026-13079 · CVE Program
- CVE-2026-13079 · NVD
- FIRST EPSS
- GHSA-qgpj-9w2h-pcv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences