Medium · 5.7 CVE-2026-115495 EUVD-2026-111145GHSA-3r72-h9fx-c3mg

Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket

Published Oct 27, 2026 · Updated Nov 4, 2026 · Assigned by WatchGuard

Vendor: WatchGuard Product: Mobile VPN with SSL Client

Description

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

Affected products

Vendor	Product	Affected	Fixed
WatchGuard	Mobile VPN with SSL Client	12.0 – < 2026.4	2026.4

Advisories 1

WID-SEC-2026-4209 WatchGuard Fireware OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026

References

https://psirt.watchguard.com/CVE-2026-115495 vendor-advisory