CVE-2026-115495

Sentinel/Defender KQL

// This vulnerability involves cleartext transmission of VPN credentials over a local management socket.
// Detection would require monitoring for unusual network traffic on loopback interfaces (127.0.0.1) that contains sensitive information.
// This is generally difficult to detect with standard EDR/SIEM logs as loopback traffic is often not logged in detail.
// Focus on process-level network connections and data exfiltration attempts from the WatchGuard VPN client process.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "wgsslvpn.exe" // Or the actual VPN client executable name
| where RemoteIP == "127.0.0.1"
| where ActionType == "ConnectionSuccess"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, Protocol, ReportId

Splunk SPL

# This vulnerability involves cleartext transmission of VPN credentials over a local management socket.
# Detection would require monitoring for unusual network traffic on loopback interfaces (127.0.0.1) that contains sensitive information.
# This is generally difficult to detect with standard EDR/SIEM logs as loopback traffic is often not logged in detail.
# Focus on process-level network connections and data exfiltration attempts from the WatchGuard VPN client process.
index=your_windows_logs sourcetype=your_network_events_sourcetype
| where InitiatingProcessFileName="wgsslvpn.exe" AND RemoteIP="127.0.0.1" AND ActionType="ConnectionSuccess"
| table _time, host, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, Protocol

Sigma

title: WatchGuard Mobile VPN Cleartext Credential Transmission
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential cleartext transmission of VPN credentials over loopback interface by the WatchGuard Mobile VPN client.
references:
  - https://psirt.watchguard.com/CVE-2026-115495
author: SecBoard
date: 2026/10/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    InitiatingProcessFileName|endswith: 'wgsslvpn.exe'
    DestinationIp: '127.0.0.1'
  condition: selection
fields:
  - InitiatingProcessCommandLine
  - DestinationPort
  - Protocol
tags:
  - attack.credential_access
  - attack.t1552.001 # Unsecured Credentials: Side-Channel Sniffing
  - cve.2026.115495

Elastic ES|QL

// This vulnerability involves cleartext transmission of VPN credentials over a local management socket.
// Detection would require monitoring for unusual network traffic on loopback interfaces (127.0.0.1) that contains sensitive information.
// This is generally difficult to detect with standard EDR/SIEM logs as loopback traffic is often not logged in detail.
// Focus on process-level network connections and data exfiltration attempts from the WatchGuard VPN client process.
from network_connection
| where process.executable.name : "wgsslvpn.exe"
| where destination.ip : "127.0.0.1"
| where event.action : "network_connection_accepted" or event.action : "network_connection_initiated"
| select @timestamp, host.name, process.executable.name, process.command_line, destination.ip, destination.port, network.protocol