WatchGuard Mobile VPN CVE-2026-115495

Requires local presence on the Windows endpoint running the WatchGuard Mobile VPN with SSL client (AV:L), with sufficient privileges to capture traffic on the loopback interface (PR:L), and the capture must occur during an active authentication/session when the username and password actually transit loopback in cleartext (the AT:P 'present' condition). Limiting factors: there is no remote or network-facing exposure, no unauthenticated path, the attacker must already have a foothold on the specific host, and success is timing-dependent on an in-progress VPN login. Affected configurations are version 12.0 prior to 2026.4; updating to 2026.4 removes the exposure.

This is a medium-severity, locally-exploitable credential-disclosure issue, not an emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) scoring 5.7 tells a consistent story with the description: the attacker must already be local to the Windows host running the client (AV:L), must already hold some privileges (PR:L), and must satisfy a timing/condition requirement (AT:P) - namely capturing loopback traffic while the user's credentials actually transit the interface. Impact is confidentiality-only (VC:H, VI:N, VA:N): disclosure of the VPN username and password, with no direct integrity or availability effect on the host. No KEV listing, no EPSS score, and no PoC or exploit reference are present in the input, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a patch-in-routine-cycle priority rather than drop-everything. The main caveat: the harvested credentials are reusable against the VPN, so the real-world blast radius depends on whether those VPN credentials unlock broader network access - a factor outside the CVSS vector that defenders should weigh.

A low-privileged user (or malware) already present on a Windows endpoint running the WatchGuard Mobile VPN with SSL client runs a packet capture on the loopback interface (127.0.0.1) and, while the user authenticates, observes the VPN username and password transmitted in cleartext. No public exploit code is identified in the sources; the technique relies on standard local traffic capture rather than a specialized exploit.