Medium severity · published Oct 27, 2026
CVE-2026-115495
Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
New
5.7
CVSS
–
EPSS
No
On KEV
Description
Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MV
Mobile VPN with SSL Client · WatchGuard
12.0 before 2026.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115495
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115495
psirt.watchguard.com
https://psirt.watchguard.com/CVE-2026-115495
More from Mobile VPN with SSL Client
7.8
CVE-2026-13079
WatchGuard Mobile VPN with SSL Windows Client Local Privilege Escalation