Securepoint SSL VPN EUVD-2026-115911

Exploitation requires an existing non-privileged local user session on a Windows machine running Securepoint SSL VPN Client v2 (PR:L, AV:L) - there is no remote or network-reachable vector and no user interaction is needed. Vector 1 (checksum authorization bypass) requires the attacker to modify an OpenVPN configuration file and have the privileged service accept an attacker-set checksum without admin rights; it depends on interacting with the privileged service. Vector 2 (argument injection via proxy settings) is broader: it requires only the ability to set the client's proxy settings and explicitly does NOT require communicating with the privileged service or modifying the protected configuration, making it the more accessible path. The principal limiting factor is the need for prior local access - this is a post-foothold escalation, not an entry point. No special non-default configuration is stated as required by the advisory.

This is a local privilege-escalation issue (CWE-88, argument/command injection) in the Securepoint SSL VPN Client v2 on Windows, letting a non-privileged local user influence OpenVPN operations performed as NT AUTHORITY\SYSTEM. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the key risk-shaping facts: exploitation is LOCAL, low-complexity, needs no user interaction, but does require an existing low-privilege foothold (PR:L) - so this is not a remote or pre-authentication threat. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a medium-severity local EoP. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or widespread exploitation; this is a prioritize-and-patch item, not a drop-everything fire. Note one discrepancy worth flagging: the vendor-supplied 4.0 impact is VC:N/VI:H/VA:H (no confidentiality impact), yet both attack vectors culminate in executing OpenVPN as SYSTEM, which in practice yields full SYSTEM code execution (and therefore confidentiality impact as well) - verify the intended impact scope with the vendor advisory. Realistic priority: genuine but bounded - a reliable attacker-already-on-the-box to SYSTEM escalation, valuable in post-compromise chains, low urgency for internet-exposure triage.

An attacker who already has an unprivileged account or code-execution foothold on a Windows host running Securepoint SSL VPN Client v2 either rewrites a protected OpenVPN configuration and self-signs a valid checksum (because the privileged service fails to authorize the client requesting the checksum update), or injects extra OpenVPN command-line arguments through unsanitized proxy settings - notably the second vector needs no interaction with the privileged service at all. When the client next processes that configuration/invocation as NT AUTHORITY\SYSTEM, the attacker's injected arguments run with SYSTEM privileges, escalating from standard user to full local administrator. No public exploit was identified at time of analysis.