This vulnerability in Forcepoint VPN Client for Windows (version 6.11.3 and prior) allows a local user without administrative rights to escalate their privileges to SYSTEM. It is categorized as CWE-250, which involves execution with unnecessary privileges. The CVSS 4.0 vector indicates the attack requires local access with low complexity and no user interaction, resulting in high impact on confidentiality, integrity, and availability. The vendor has not published any remediation or patch information yet, and no exploits are known in the wild.

An attacker with local access to a vulnerable Forcepoint VPN Client installation can gain SYSTEM-level privileges, potentially allowing full control over the affected system. This can lead to unauthorized actions, including installing software, modifying system configurations, or accessing sensitive data. The high CVSS score reflects the significant risk posed by this vulnerability if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to systems running affected versions of Forcepoint VPN Client and consider applying temporary workarounds if provided by the vendor. Monitor vendor channels for updates and apply patches promptly once available.