WatchGuard has disclosed two critical vulnerabilities in its Windows-based WatchGuard Agent that could allow unauthenticated attackers to execute arbitrary code with elevated privileges.
The flaws, tracked as CVE-2026-57910 and CVE-2026-57909, affect WatchGuard Agent versions earlier than 1.25.13.0000. The security issues were published on August 25, 2026.
WatchGuard said it is not aware of either vulnerability being exploited in the wild at the time of disclosure. However, the severity and low attack complexity make prompt patching important for organizations running the affected endpoint protection component.
CVE-2026-57910 has received a CVSS v4.0 score of 9.3 and is described as an improper authentication flaw. An unauthenticated attacker with network access could abuse the agent’s UDP discovery and command service to trigger the TaskExecute event handler.
The attack could cause the vulnerable agent to download and execute an attacker-controlled program. Since the WatchGuard Agent commonly operates with highly privileged permissions, successful exploitation could result in code execution as SYSTEM on Windows systems.
This level of access would allow an attacker to install malware, alter security configurations, create persistence mechanisms, access sensitive files, and move further across an enterprise network.
WatchGuard Agent for Windows Vulnerability
WatchGuard linked CVE-2026-57910 to several weakness categories, including missing authentication for a critical function, improper verification of cryptographic signatures, and downloading code without an integrity check.
The combination suggests that the affected service did not sufficiently validate either the remote requester or the program it was instructed to retrieve and execute.
The second issue, CVE-2026-57909, carries a CVSS v4.0 score of 9.4. It is a path traversal vulnerability that can allow an unauthenticated attacker on an adjacent network to execute arbitrary code on an affected WatchGuard Agent installation.
According to WatchGuard, successful exploitation of CVE-2026-57909 could result in a complete loss of confidentiality, integrity, and availability of the affected endpoint protection component.
The flaw stems from inadequate control over code generation and the absence of authentication for critical functionality, creating a path for attackers to bypass security controls and run malicious code remotely.
Organizations should upgrade affected Windows deployments to WatchGuard Agent 1.25.13.0000 or later. WatchGuard also listed versions 1.17.02.0000 and 1.17.21.0000 as fixes for CVE-2026-57910, while CVE-2026-57909 requires version 1.25.13.0000.
Security teams should identify all WatchGuard Agent installations, confirm their installed versions, and prioritize updates on systems exposed to untrusted or shared network segments.
Until patching is complete, administrators should limit access to the agent’s UDP discovery and command service through network segmentation and firewall rules.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
