WatchGuard Patches Critical Privilege-Escalation Flaw in Mobile VPN IPSec Client for Windows WatchGuard has issued a security advisory addressing a significant privilege-escalation vulnerability (WGSA-2026-00002 / NCPVE-2025-0626) in its Mobile VPN with IPSec client for Windows, which could allow local attackers to execute arbitrary commands with SYSTEM-level privileges. The flaw stems from underlying software technology provided by NCP Engineering and affects the installation management process, enabling attackers to bypass administrative protections. The vulnerability manifests during installation, updates, or uninstallation of the software, where the MSI installer launches command-line windows (cmd.exe) running under the SYSTEM account the highest privilege level in Windows. On older Windows versions, these command prompts are interactive, allowing attackers to interrupt the process, interact with the open prompt, and execute malicious commands with inherited SYSTEM rights. While the CVSS score is 6.3 (Medium), the impact metrics rate Confidentiality, Integrity, and Availability as High, indicating a full system compromise if exploited. The flaw affects WatchGuard Mobile VPN with IPSec client versions up to and including 15.19. No workarounds exist, and remediation requires upgrading to version 15.33 or higher, which modifies installer behavior to prevent exposure of elevated command prompts. Organizations using legacy Windows systems are at heightened risk due to the interactive nature of the vulnerability. WatchGuard and NCP Engineering have released the patch to address the issue.