CVE-2026-13079: WatchGuard Mobile VPN Privilege Escalation

CVE-2026-13079 Overview

CVE-2026-13079 is a local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows. A local attacker with low-privileged access can escalate to NT AUTHORITY\SYSTEM on any machine where the vulnerable client is installed. The flaw is categorized under [CWE-732] (Incorrect Permission Assignment for Critical Resource), indicating that sensitive files, directories, or services associated with the VPN client are exposed with overly permissive access rights.

Critical Impact
Any authenticated user on a Windows endpoint running the affected VPN client can obtain full SYSTEM-level control, defeating endpoint security boundaries and enabling persistence, credential theft, and lateral movement.

Affected Products

WatchGuard Mobile VPN with SSL client for Windows
All versions up to and including 2026.2
Windows endpoints running the vulnerable client

Discovery Timeline

2026-07-03 - CVE-2026-13079 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-13079

Vulnerability Analysis

The vulnerability affects the WatchGuard Mobile VPN with SSL client for Windows through version 2026.2. It maps to [CWE-732], which describes incorrect permission assignment on a critical resource. In practical terms, the VPN client installation exposes files, directories, services, or registry keys that low-privileged local users can modify. Because the associated service or process executes with NT AUTHORITY\SYSTEM privileges, an attacker who alters those resources can trigger execution of attacker-controlled code in the SYSTEM security context. This is a local-only attack requiring existing low-privilege access to the endpoint.

Root Cause

The root cause is an insecure permission configuration on a resource used by the VPN client. Access control lists (ACLs) applied during installation or runtime grant write or modify rights to non-privileged users on components that a SYSTEM-level process reads or executes. This class of flaw commonly manifests as writable service binaries, writable installation directories in non-standard paths, unquoted service paths, or DLL search order issues combined with weak folder permissions.

Attack Vector

Exploitation requires local access with any authenticated user context. The attacker replaces or modifies a resource that the privileged VPN service or auto-elevated component loads. When the service starts, restarts, or is invoked (for example, at boot or user reconnection), the attacker's payload executes as NT AUTHORITY\SYSTEM. No user interaction beyond the attacker's own actions is required. Full technical details are documented in the WatchGuard Security Advisory.

Detection Methods for CVE-2026-13079

Indicators of Compromise

Unexpected modifications to files or directories under the WatchGuard Mobile VPN with SSL installation path.
New or modified executables, DLLs, or configuration files owned by non-administrative users within the VPN client directory.
Child processes spawned by the WatchGuard VPN service running under NT AUTHORITY\SYSTEM that do not match the vendor's signed binaries.
Service restarts of the WatchGuard SSL VPN service closely followed by suspicious SYSTEM-level process creation.

Detection Strategies

Audit NTFS ACLs on the VPN client installation directory and service binary paths, flagging any entry granting write access to Users, Authenticated Users, or Everyone.
Enable Windows Security event logging for object access (Event IDs 4663, 4670) on VPN client directories and monitor for modifications by non-privileged accounts.
Correlate Sysmon Event ID 1 (process creation) with Event ID 7 (image load) to catch unsigned or user-writable DLLs being loaded by the SYSTEM-context VPN process.

Monitoring Recommendations

Deploy file integrity monitoring on the WatchGuard Mobile VPN with SSL client installation path and its service executable.
Track service configuration changes via Event ID 7045 and registry modifications under HKLM\SYSTEM\CurrentControlSet\Services for the VPN service.
Alert on any privilege escalation pattern where a standard user process is followed by a SYSTEM process originating from the VPN client directory.

How to Mitigate CVE-2026-13079

Immediate Actions Required

Inventory all Windows endpoints running the WatchGuard Mobile VPN with SSL client and identify installed versions.
Upgrade to a fixed version above 2026.2 as published in the WatchGuard Security Advisory.
Restrict local logon rights on high-value systems until patching is complete, reducing the pool of accounts able to exploit the flaw.
Review installation directory ACLs and remove write permissions granted to non-administrative principals.

Patch Information

WatchGuard has published guidance in advisory wgsa-2026-00027. Administrators should apply the vendor-supplied fixed release for the Mobile VPN with SSL client for Windows. All versions up to and including 2026.2 are affected and must be updated. Refer to the WatchGuard Security Advisory for the current fixed version and download instructions.

Workarounds

Manually harden ACLs on the VPN client installation directory to remove write, modify, and create permissions for non-administrative users.
Restrict interactive and remote logon on systems where the client is installed to trusted administrators only.
Where feasible, temporarily uninstall the Mobile VPN with SSL client on shared or multi-user workstations until the patched version is deployed.

bash

# Configuration example - audit and harden ACLs on the VPN client directory
icacls "C:\Program Files (x86)\WatchGuard\WatchGuard Mobile VPN with SSL"
icacls "C:\Program Files (x86)\WatchGuard\WatchGuard Mobile VPN with SSL" /remove:g "Users" "Authenticated Users"
icacls "C:\Program Files (x86)\WatchGuard\WatchGuard Mobile VPN with SSL" /inheritance:r