Loading story…
Two separate local privilege-escalation issues were disclosed in widely deployed Windows remote-access clients. WatchGuard published an advisory for NCP IPSec VPN Client as shipped with WatchGuard Mobile VPN with IPSec for Windows, where installation/update/uninstall actions can briefly open interactive cmd.exe windows running as SYSTEM; on older Windows versions, an attacker with local access can execute commands in that prompt to gain SYSTEM privileges and bypass administrative protections. WatchGuard states the issue affects versions up to 15.19 and is fixed in 15.33 (advisory WGSA-2026-00002, tracked as NCPVE-2025-0626).
Separately, reporting described a privilege-escalation weakness in Check Point Harmony SASE (Perimeter81) Windows client tracked as CVE-2025-9142, affecting versions below 12.2. The issue is attributed to insufficient validation of JWT values passed via a URI handler (perimeter81://) to a SYSTEM-privileged service component (Perimeter81.Service.exe), enabling directory traversal (e.g., ../../../) and file write/delete outside the intended certificate working directory; the described attack chain includes crafting a malicious URL, abusing a whitelisted auth domain, and using symlink/object-manager tricks to redirect certificate writes performed with SYSTEM privileges, potentially leading to full local compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
WatchGuard published advisory WGSA-2026-00002 covering a privilege-escalation vulnerability in the NCP IPSec VPN Client MSI Installer, identified as NCPVE-2025-0626. No additional technical details were provided in the reference content.
In January 2026, details of the Check Point Harmony SASE Windows client privilege-escalation issue were publicly disclosed. Organizations were advised to upgrade to version 12.2 or later and apply hardening measures to reduce DLL injection and local abuse risk.
In November 2025, Check Point released Harmony SASE agent version 12.2 to fix CVE-2025-9142, which affected versions prior to 12.2. The update addressed a chain that could enable directory traversal, arbitrary file writes, and eventual SYSTEM-level code execution.
Check Point was notified in March 2025 about a local privilege-escalation vulnerability in the Harmony SASE Windows client (Perimeter81), later tracked as CVE-2025-9142. The flaw involved abuse of an unverified JWT in a URI handler/IPC path to influence SYSTEM-level certificate file writes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
watchguard.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard issued advisories for a **local privilege-escalation** flaw in *Mobile VPN with IPSec* for Windows (third-party NCP-based client), tracked as **WGSA-2026-00002 / NCPVE-2025-0626**. During installation, update, or uninstallation, the MSI process can spawn `cmd.exe` windows running as **SYSTEM**; on some/older Windows configurations these prompts may be interactive, enabling a local user to hijack the process and execute arbitrary commands with **SYSTEM-level** privileges. The issue is scored **CVSS 6.3 (Medium)** but can result in full host compromise; guidance indicates affected users should update the client (reported as vulnerable up to **v15.19**) to a fixed release (reported as **v15.33**). In a separate WatchGuard advisory, the company also addressed an **LDAP injection** vulnerability in **Fireware OS** on *Firebox* appliances, tracked as **CVE-2026-1498** with a reported **CVSS 7.0**. The flaw is described as residing in the authentication interface and could allow a remote, unauthenticated attacker to manipulate LDAP queries, potentially exposing or extracting sensitive data from authentication backends; organizations running Firebox devices were advised to apply the relevant Fireware OS updates to mitigate the risk.
Jun 29, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
A critical vulnerability in the JumpCloud Remote Assist for Windows agent (CVE-2025-34352) allows a standard user on a company-managed device to gain full, persistent SYSTEM-level control. The flaw, discovered by XM Cyber, arises from the agent's uninstallation process, which performs privileged file operations in a user-controlled temporary folder. This enables local users to exploit the uninstall routine to overwrite or delete sensitive system files, resulting in either local privilege escalation or denial of service. Over 180,000 organizations using JumpCloud are potentially at risk until the issue is remediated. Separately, Microsoft’s Windows Admin Center (WAC) is affected by a local privilege escalation vulnerability (CVE-2025-64669) due to insecure directory permissions on `C:\ProgramData\WindowsAdminCenter`. Standard users can write to this directory, which is also accessed by services running with elevated privileges, allowing attackers to exploit extension uninstall mechanisms or DLL hijacking to obtain SYSTEM-level access. Both vulnerabilities highlight the risks posed by improper privilege separation and insecure file system permissions in widely deployed Windows management tools.
Jun 29, 2026