WatchGuard VPN Client Flaw on Windows
WatchGuard has released a critical security update for its Mobile VPN with IPSec client for Windows to address a privilege escalation vulnerability.
The flaw, originating in the underlying software provided by NCP engineering, allows local attackers to execute arbitrary commands with the highest available privileges on a compromised machine.
The vulnerability is tracked as NCPVE-2025-0626 (WatchGuard Advisory WGSA-2026-00002).
It affects the WatchGuard Mobile VPN with IPSec client for Windows, specifically versions 15.19 and older.
The issue resides within the MSI installer process used during the software’s lifecycle management.
The security defect manifests during specific administrative actions, including the installation, update, or uninstallation of the VPN client.
During these processes, the application temporarily spawns command-line windows (cmd.exe) running under the SYSTEM account.
On older versions of Windows, these command prompts are interactive. This creates a race condition window where a local attacker with low-level privileges can interact with the open command prompt.
By doing so, they can execute arbitrary programs or commands that inherit the SYSTEM rights.
This successfully bypasses administrative protection mechanisms, granting the attacker unrestricted control over the endpoint.
The vulnerability carries a CVSS v4.0 score of 6.3 (Medium). While the attack requires local access and user interaction (Low Privileges required), the impact of a successful exploit is high regarding System Confidentiality, Integrity, and Availability.
WatchGuard and NCP have released a patch to close this security gap. The vulnerability is resolved in the WatchGuard Mobile VPN with IPSec client for Windows version 15.33.
Security administrators and SOC teams are advised to identify endpoints running vulnerable versions of the IPSec client and deploy the version 15.33 update immediately.
There are no workarounds available for this flaw, patching is the only viable mitigation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…