Which versions of WatchGuard Mobile VPN are affected by CVE-2026-13079?

WatchGuard Mobile VPN with SSL client for Windows (versions up to 2026.2) exposes every installed endpoint to local privilege escalation attacks, allowing any local actor to seize complete…

How to fix or mitigate CVE-2026-13079?

Within 24 hours: Inventory all Windows systems with WatchGuard Mobile VPN SSL client versions 2026.2 and earlier; restrict local interactive logon permissions for non-administrative users. Within 7 days: Contact WatchGuard for patch timeline confirmation; assess business criticality of VPN client on each system; implement endpoint monitoring to detect privilege escalation attempts. Within 30 days: Apply vendor patch upon release to versions 2026.3 or later; for any unpatched systems, enforce principle-of-least-privilege controls and evaluate migration to alternative VPN solutions.

WatchGuard Mobile VPN CVE-2026-13079

Q: What is the CVSS score of CVE-2026-13079?

CVE-2026-13079 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41460 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-02 WatchGuard

GHSA-qgpj-9w2h-pcv3

Privilege Escalation Watchguard Microsoft Fireware Os

7.3

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local vector with an existing low-priv account (PR:L); AC:H reflects the CVSS 4.0 attack requirement (AT:P) making the primitive non-deterministic; full SYSTEM compromise yields C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:53 vuln.today

CVE Published

Jul 02, 2026 - 23:07 cve.org

HIGH 7.3

DescriptionCVE.org

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed.

This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.

AnalysisAI

Local privilege escalation in WatchGuard Mobile VPN with SSL client for Windows (versions up to and including 2026.2) lets an authenticated local attacker elevate from a low-privileged account to NT AUTHORITY\SYSTEM on any machine where the client is installed. The flaw is rooted in insecure permission assignment (CWE-732), and there is no public exploit identified at time of analysis, though the vendor-reported nature and full high-impact CVSS (7.3, CVSS 4.0) make it a meaningful endpoint-hardening concern.

Technical ContextAI

The affected component is WatchGuard's Mobile VPN with SSL client, the Windows-side software users run to establish SSL VPN tunnels to a WatchGuard Firebox/Fireware appliance. The root cause is classified as CWE-732 (Incorrect Permission Assignment for a Critical Resource), a class in which a security-relevant object - such as a service binary, its installation directory, a configuration file, a named pipe, or a scheduled/service process running as SYSTEM - is left writable or replaceable by non-privileged local users. When a SYSTEM-level service loads or executes such an attacker-controllable resource, the attacker inherits SYSTEM privileges. The supplied CPE string (cpe:2.3:a:watchguard:fireware_os) points at Fireware OS rather than the client itself, which is inconsistent with the description and appears to be a cataloging artifact rather than an accurate identifier of the vulnerable code.

RemediationAI

Consult WatchGuard PSIRT advisory WGSA-2026-00027 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00027) and upgrade the Mobile VPN with SSL client for Windows to the fixed release identified there; no exact fixed version number was included in the provided data, so verify the target build directly from the advisory before deployment. As a compensating control until patched, restrict which users can log on interactively to endpoints running the client and remove unnecessary local accounts, since exploitation requires an existing low-privileged local session. Additionally, tighten filesystem and service ACLs on the client's installation directory and service executable so non-administrative users cannot write to or replace them, and monitor for unexpected child processes spawned by the VPN service running as SYSTEM; note these ACL changes may interfere with client auto-update and must be validated against the vendor's supported configuration.