TI-2026-81390 Aliases CVE-2026-115495 GHSA-3r72-h9fx-c3mg

Cleartext VPN credentials in WatchGuard Mobile VPN with SSL client

LOW 24CWE-319Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

The WatchGuard Mobile VPN with SSL client for Windows sends VPN credentials in cleartext over its local management socket (CWE-319). A local attacker who can capture loopback traffic can read the user's VPN username and password. Affected versions are from 12.0 before 2026.4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00078 0th percentileScored 2026-11-07

Fix Fixed Mobile VPN with SSL Client (WatchGuard): 2026.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WatchGuard	Mobile VPN with SSL Client	12.0 to before 2026.4	2026.4	Patch available	CNA

Mobile VPN with SSL Client VendorWatchGuard Affected 12.0 to before 2026.4 Fixed in 2026.4 Patch available CNA

Remediation

Update WatchGuard Mobile VPN with SSL client for Windows to version 2026.4 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Mobile VPN with SSL Client (WatchGuard) Fixed in 2026.4

Timeline

2026-10-27 Threatist record created from CVE-2026-115495
2026-10-27 Alias added: GHSA-3r72-h9fx-c3mg
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Advisory 1

https://psirt.watchguard.com/CVE-2026-115495

TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5

See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences