Loading story…
WatchGuard issued advisories for a local privilege-escalation flaw in Mobile VPN with IPSec for Windows (third-party NCP-based client), tracked as WGSA-2026-00002 / NCPVE-2025-0626. During installation, update, or uninstallation, the MSI process can spawn cmd.exe windows running as SYSTEM; on some/older Windows configurations these prompts may be interactive, enabling a local user to hijack the process and execute arbitrary commands with SYSTEM-level privileges. The issue is scored CVSS 6.3 (Medium) but can result in full host compromise; guidance indicates affected users should update the client (reported as vulnerable up to v15.19) to a fixed release (reported as v15.33).
In a separate WatchGuard advisory, the company also addressed an LDAP injection vulnerability in Fireware OS on Firebox appliances, tracked as CVE-2026-1498 with a reported CVSS 7.0. The flaw is described as residing in the authentication interface and could allow a remote, unauthenticated attacker to manipulate LDAP queries, potentially exposing or extracting sensitive data from authentication backends; organizations running Firebox devices were advised to apply the relevant Fireware OS updates to mitigate the risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
To remediate CVE-2026-1498, WatchGuard recommended upgrading Firebox appliances to fixed Fireware OS releases including 2026.1, 12.11.7, and 12.5.13 for applicable models. These updates address the LDAP injection exposure in the web authentication interface.
WatchGuard also published details of CVE-2026-1498, an LDAP injection flaw in the Fireware OS authentication interface that could let a remote unauthenticated attacker retrieve sensitive information from a connected LDAP server and potentially authenticate as an LDAP user with a partial identifier if the passphrase is known. Affected versions include Fireware OS 12.0 through 12.11.6 and 2025.1 through 2025.1.4.
WatchGuard said the Windows VPN client privilege-escalation issue was fixed and advised customers to upgrade to Mobile VPN with IPSec client version 15.33 or later, with no workaround other than updating. The fix addresses the installer-related command execution risk on affected Windows systems.
WatchGuard issued advisory WGSA-2026-00002 for a local privilege-escalation vulnerability in the Mobile VPN with IPSec client for Windows, traced to NCP-provided MSI installer behavior that can expose interactive cmd.exe windows with SYSTEM privileges during install, update, or uninstall. The flaw affects client versions up to and including 15.19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate local privilege-escalation issues were disclosed in widely deployed Windows remote-access clients. WatchGuard published an advisory for **NCP IPSec VPN Client** as shipped with *WatchGuard Mobile VPN with IPSec* for Windows, where installation/update/uninstall actions can briefly open interactive `cmd.exe` windows running as **SYSTEM**; on older Windows versions, an attacker with local access can execute commands in that prompt to gain **SYSTEM** privileges and bypass administrative protections. WatchGuard states the issue affects versions up to **15.19** and is fixed in **15.33** (advisory **WGSA-2026-00002**, tracked as **NCPVE-2025-0626**). Separately, reporting described a privilege-escalation weakness in **Check Point Harmony SASE (Perimeter81) Windows client** tracked as **CVE-2025-9142**, affecting versions **below 12.2**. The issue is attributed to insufficient validation of **JWT** values passed via a URI handler (`perimeter81://`) to a SYSTEM-privileged service component (`Perimeter81.Service.exe`), enabling directory traversal (e.g., `../../../`) and file write/delete outside the intended certificate working directory; the described attack chain includes crafting a malicious URL, abusing a whitelisted auth domain, and using symlink/object-manager tricks to redirect certificate writes performed with SYSTEM privileges, potentially leading to full local compromise.
Jun 29, 2026
WatchGuard disclosed two high-severity vulnerabilities in **Fireware OS** affecting Firebox appliances, including a path traversal flaw in the **Web UI** tracked as `CVE-2026-3987` and an insecure deserialization issue in the **Access Portal** tracked as `CVE-2026-4266`. The Web UI bug can let a privileged, authenticated remote attacker perform an arbitrary file write and potentially execute code in the context of an elevated system process. The Access Portal flaw can lead to arbitrary code execution as the `portald` user through insecure deserialization. The issues affect multiple Fireware OS release lines, with `CVE-2026-3987` impacting versions `12.6.1` through `12.11.8` and `2025.1` through `2026.1.2`, while `CVE-2026-4266` affects versions `12.1` through `12.11.8` and `2025.1` through `2026.1.2`. WatchGuard said the deserialization bug is not a standalone remote exploit and requires prior write access to the local filesystem, making it more relevant for post-compromise chaining. The vulnerabilities are mapped to `CWE-22` and `CWE-502`, respectively, and WatchGuard published vendor guidance including advisory `WGSA-2026-00009`; Firebox models without Access Portal support, such as the **T-15** and **T-35**, are not affected by the Access Portal issue.
Jul 3, 2026
WatchGuard published security advisories for multiple **Fireware OS** vulnerabilities affecting **Firebox** appliances and related deployments, and the Canadian Centre for Cyber Security urged organizations to apply updates. The issues include an **out-of-bounds write** that could allow a privileged, authenticated administrator to achieve **root-level arbitrary code execution** via an exposed management interface (**CVE-2026-3342**), and a **filesystem integrity check bypass** that could allow an attacker to maintain **limited persistence** by using a maliciously crafted firmware update package (**CVE-2026-3344**). A separate advisory also notes a **reflected XSS** issue in the Fireware Web UI (**CVE-2026-3343**). Affected versions span multiple Fireware OS branches, including **12.0–12.11.7**, **12.5.9–12.5.16** (T15/T35 models), and **2025.1–2026.1.1**, with additional impact noted for **11.x** in the out-of-bounds write advisory (11.x is end-of-life). WatchGuard’s fixes are available in **12.11.8**, **12.5.17**, and **2026.1.2** (depending on branch/model), and no workaround was listed for the integrity-check bypass or out-of-bounds write issues; organizations should prioritize patching and ensure management interfaces are not unnecessarily exposed.
Jul 3, 2026