{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","title":"NCP IPSec VPN Client MSI Installer Privilege Escallation (NCPVE-2025-0626)","distribution":{"tlp":{"label":"CLEAR"}},"publisher":{"category":"vendor","name":"WatchGuard PSIRT","namespace":"https://www.watchguard.com"},"tracking":{"id":"WGSA-2026-00002","status":"final","version":"10","initial_release_date":"2026-01-29T12:00:00+00:00","current_release_date":"2026-07-28T02:26:19.144012+00:00","revision_history":[{"date":"2026-01-29T12:00:00+00:00","number":"10","summary":"Initial release."}]},"references":[{"summary":"vendor-advisory","url":"https://psirt.watchguard.com/WGSA-2026-00002"}],"notes":[{"category":"summary","text":"During certain actions such as installation, update, or uninstallation, command line windows (cmd.exe) are temporarily opened with the rights of the SYSTEM account. In older versions of Windows, it is possible to execute any commands or programs with SYSTEM privileges in these interactive command prompts. This allows an attacker to bypass administrative protection mechanisms and gain unrestricted access to the system.","title":"Summary"}]},"product_tree":{"branches":[{"category":"vendor","name":"WatchGuard","branches":[{"category":"product_name","name":"IPSec VPN Client (NCP)","branches":[{"category":"product_version_range","name":"vers >= 15.0, < 15.33","product":{"name":"IPSec VPN Client (NCP) vers >= 15.0, < 15.33","product_id":"CSAFPID-d969168a-b004-4c55-afbb-fd44d62472ed"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"During certain actions such as installation, update, or uninstallation, command line windows (cmd.exe) are temporarily opened with the rights of the SYSTEM account. In older versions of Windows, it is possible to execute any commands or programs with SYSTEM privileges in these interactive command prompts. This allows an attacker to bypass administrative protection mechanisms and gain unrestricted access to the system.","title":"Summary"}],"product_status":{"known_affected":["CSAFPID-d969168a-b004-4c55-afbb-fd44d62472ed"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to IPSec VPN Client (NCP) 15.33 or later.","product_ids":["CSAFPID-d969168a-b004-4c55-afbb-fd44d62472ed"]}]}]}