Description
Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.
Published: 2026-10-27
Score: 5.7 Medium
EPSS: n/a
KEV: No
Impact: Confidentiality breach via credential disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability in WatchGuard Mobile VPN with SSL Client for Windows allows cleartext transmission of VPN credentials over a local management socket. A local attacker who can capture loopback traffic can read the user's VPN username and password, resulting in disclosure of sensitive authentication data and a breach of confidentiality.

Affected Systems

Installing this client on Windows machines and not updating to Fireware OS 2026.4 exposes the system. All versions of the Mobile VPN with SSL Client that lack the patch are affected. No additional version specifics are provided.

Risk and Exploitability

A CVSS base score of 5.7 reflects moderate risk. EPSS data is not available and the vulnerability is not in the CISA KEV catalog. The exploit requires local access to the workstation to capture loopback traffic, confining the threat to users or insiders with local privileges.

Generated by OpenCVE AI on October 27, 2026 at 18:54 UTC.

Remediation

Vendor Solution

Fireware OS 2026.4

OpenCVE Recommended Actions

  • Upgrade to Fireware OS 2026.4 to patch the credential disclosure vulnerability.
  • Reinstall or reconfigure the Mobile VPN client after the firmware upgrade to ensure the patch is applied.
  • If the application allows, disable or restrict the local management socket to prevent exposure over loopback traffic.

Generated by OpenCVE AI on October 27, 2026 at 18:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.
Title Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
First Time appeared Watchguard
Watchguard mobile Vpn With Ssl Client
Weaknesses CWE-319
CPEs cpe:2.3:a:watchguard:mobile_vpn_with_ssl_client:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard mobile Vpn With Ssl Client
References
Metrics cvssV4_0

{'score': 5.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Mobile Vpn With Ssl Client
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-10-27T15:55:13.638Z

Reserved: 2026-10-22T15:44:41.824Z

Link: CVE-2026-115495

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T16:17:30.420

Modified: 2026-10-27T16:17:30.420

Link: CVE-2026-115495

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:00:08Z

Weaknesses
  • CWE-319

    Cleartext Transmission of Sensitive Information