Which versions of Forcepoint VPN Client are affected by EUVD-2025-210063?

Forcepoint VPN Client for Windows (versions 6.11.3 and earlier) contains a local privilege escalation vulnerability allowing authenticated users with low privileges to escalate to SYSTEM-level…

How to fix or mitigate EUVD-2025-210063?

Within 24 hours: Inventory all Windows systems running Forcepoint VPN Client 6.11.3 or earlier and assess business criticality. Within 7 days: Restrict local interactive logon access where operationally feasible (enforce VPN-only or Remote Desktop connectivity); enable Windows privilege escalation auditing (Event ID 4672); apply application whitelisting to VPN client executables. Within 30 days: Monitor Forcepoint security advisories for patch release timeline; if no patch announced, conduct risk assessment for network segmentation or alternative VPN solutions.

Forcepoint VPN Client EUVD-2025-210063

Q: What is the CVSS score of EUVD-2025-210063?

EUVD-2025-210063 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-12694 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-06-04 psirt@forcepoint.com

GHSA-8w99-hmp7-97xw

Microsoft Privilege Escalation Vpn Client

8.5

CVSS 4.0 · Vendor: forcepoint

Severity by source

Vendor (forcepoint) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (forcepoint) · only source for this CVE.

CVSS VectorVendor: forcepoint

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 12:31 vuln.today

CVE Published

Jun 04, 2026 - 12:16 nvd

HIGH 8.5

DescriptionCVE.org

A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.

AnalysisAI

Local privilege escalation in Forcepoint VPN Client for Windows versions 6.11.3 and prior allows an authenticated low-privileged local user to elevate to SYSTEM. The flaw stems from execution with unnecessary privileges (CWE-250) and carries a CVSS 4.0 score of 8.5, but no public exploit identified at time of analysis. The vulnerability was reported and disclosed by Forcepoint PSIRT itself rather than a third party.

Technical ContextAI

Forcepoint VPN Client is the Windows endpoint agent that establishes IPsec/SSL tunnels to Forcepoint NGFW/Sidewinder gateways and runs persistent privileged services to manage network adapters, routing, and policy enforcement. The CWE-250 classification (Execution with Unnecessary Privileges) indicates that a SYSTEM-level component of the client performs operations on behalf of the logged-in user without sufficiently dropping or restricting privileges - common patterns include privileged services that load user-controlled files, expose insecure named pipes/IPC, invoke binaries from writable locations, or honor user-supplied paths. The scope-unchanged CVSS vector confirms the elevation is confined to the local Windows host but yields full Confidentiality, Integrity, and Availability impact (VC:H/VI:H/VA:H) consistent with NT AUTHORITY\SYSTEM compromise.

RemediationAI

Patch available per vendor advisory - upgrade Forcepoint VPN Client for Windows to a version released after 6.11.3 as directed in the Forcepoint Security Advisory at https://support.forcepoint.com/s/article/Security-Advisory-Local-Privilege-Escalation-in-VPN-Client-for-Windows; the advisory should be consulted for the exact fixed build number since it was not enumerated in the provided data. Until patching is complete, compensating controls include restricting interactive logon on endpoints that run the VPN client to trusted users only (which limits who can stage a local exploit but does not help against malware-initiated abuse), enforcing application allow-listing via WDAC or AppLocker to block unsigned helper binaries that an LPE chain may rely on, and monitoring EDR for suspicious child processes spawned by the Forcepoint VPN service or unexpected writes into its install directory; note that uninstalling or stopping the client service eliminates the vulnerability but also removes VPN connectivity, which is rarely acceptable for remote workers.