WatchGuard Mobile VPN CVE-2026-13079

Exploitation requires the WatchGuard Mobile VPN with SSL client for Windows (version ≤ 2026.2) to be installed on the target machine, and the attacker must already possess a low-privileged local session on that machine (CVSS PR:L) - this is not remotely reachable (AV:L). The CVSS 4.0 AT:P metric indicates an additional attack requirement must be satisfied, meaning exploitation is not unconditional; a specific condition such as a timing/race window or an attacker-writable path must be present. Limiting factors: no network vector, a valid local foothold is mandatory, and only hosts with the client installed are affected - servers and endpoints without the SSL VPN client are out of scope.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) describes a locally exploitable issue requiring an existing low-privileged foothold (PR:L) plus a specific attack requirement (AT:P), which raises exploitation to high vulnerable-system impact (VC:H/VI:H/VA:H) - full compromise of the endpoint. This is NOT a remote or wormable issue: it cannot be triggered over the network and requires the attacker to already be logged on or to have code execution as a normal user, so it is a post-compromise escalation primitive rather than an initial-access bug. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified. The AT:P (attack requirement) metric signals that exploitation is not fully deterministic - a race window, a particular install condition, or user-controlled path may be needed - which somewhat limits reliability. Net: a genuine but second-stage privilege-escalation risk, high-value on endpoints where the client is broadly deployed, but gated behind prior local access.

An attacker who has already gained an ordinary user account on a Windows workstation - via phishing, a stolen credential, or a low-privilege malware foothold - leverages the insecurely-permissioned resource in the installed Mobile VPN with SSL client to have SYSTEM-level code execute their payload. Meeting the attack-requirement condition (AT:P), they obtain a SYSTEM shell and use it to disable security tooling, install persistence, and harvest credentials. No public proof-of-concept has been identified at time of analysis.