CVE-2026-115495#

Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket

Medium 5.7 CVSS v4.0 › Published 2026-10-27Updated 2026-10-27

Summary #

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

Product status #

Product	Affected	Not affected
Mobile VPN with SSL Client
Windows	>= 12.0, < 2026.4	>= 2026.4

Weakness Type and Impact #

CWECWE-319Cleartext Transmission of Sensitive Information
CAPECCAPEC-158Sniffing Network Traffic

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 2026.4

References #

Credits #

Discovered internally by WatchGuardfinder