---
id: CVE-2026-115495
title: >-
  Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN
  Credentials over Local Management Socket
summary: >-
  Cleartext Transmission of Sensitive Information vulnerability in the
  WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who
  can capture loopback traffic to obtain the user’s VPN username and password.
severity: medium
cvss: 5.7
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-319
vendor: WatchGuard
product: Mobile VPN with SSL Client
affected:
  - mobile_vpn_with_ssl_client >= 12.0 < 2026.4
published: '2026-10-27'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T17:10:25.690Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115495'
references:
  - url: 'https://psirt.watchguard.com/CVE-2026-115495'
tags:
  - cve.org
epss: 0.00078
epssPercentile: 0.00116
ingestedAt: '2026-10-27T16:11:59.483Z'
---

## Overview

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

## Affected

- `mobile_vpn_with_ssl_client >= 12.0 < 2026.4`

## Remediation

Mobile VPN with SSL Client 2026.4