WatchGuard Exposes Critical Vulnerabilities in WatchGuard Agent
WatchGuard Technologies has announced the discovery of two critical vulnerabilities affecting its Windows WatchGuard Agent. These vulnerabilities, identified as CVE-2026-57910 and CVE-2026-57909, possess alarming CVSS v4.0 scores of 9.3 and 9.4 respectively, highlighting the significant risk they pose to users. The issues specifically impact versions of the WatchGuard Agent released prior to 1.25.13.0000, making it imperative for organizations to address this problem promptly.
If successfully exploited, these vulnerabilities could grant unauthorized attackers full control over affected endpoints, with the potential to elevate to SYSTEM-level privileges on Windows systems. This level of access enables intruders to compromise the entire system, posing serious security risks to sensitive information and organizational infrastructure.
Authentication Bypass Enables Code Execution
The first vulnerability, CVE-2026-57910, is categorized as an improper authentication flaw that targets the UDP discovery and command service functionality of the WatchGuard Agent. This specific issue allows an unauthenticated attacker with network access to exploit the agent’s TaskExecute event handler. By doing so, the attacker can trigger the service to download and execute a malicious program controlled by them.
Given that the WatchGuard Agent generally operates with elevated privileges, successful exploitation can result in arbitrary code execution with root or SYSTEM permissions, depending on the deployment platform. In practical terms, this means that an attacker can install malware, maintain persistent access, access confidential files, modify security configurations, or use the compromised endpoint as a launchpad for lateral movement within the network.
WatchGuard has classified this flaw under several weakness categories, including:
- CWE-306: Missing Authentication for Critical Function
- CWE-347: Improper Verification of Cryptographic Signature
- CWE-494: Download of Code Without Integrity Check
This categorization spotlights the seriousness of the vulnerability, as it exposes a remotely accessible service that acts without adequate authentication and retrieves code without proper integrity validation.
Path Traversal Flaw Introduction
The second vulnerability, CVE-2026-57909, is identified as a path traversal flaw that similarly allows for unauthenticated remote code execution. Unlike CVE-2026-57910, which only requires general network access, exploitation of CVE-2026-57909 necessitates the attacker to be on an adjacent network. This requirement, while slightly narrowing the potential attack surface, still presents a significant risk, especially in enterprise settings.
WatchGuard has emphasized that a successful exploitation of this vulnerability could lead to a total compromise of the confidentiality, integrity, and availability of the affected endpoint. This vulnerability is linked to CWE-94, which deals with improper control of code generation, and CWE-306, highlighting again the absence of critical authentication measures.
Despite the proximity requirement that limits exposure compared with vulnerabilities accessible over the internet, organizations should remain vigilant. Attackers gaining access to corporate Wi-Fi networks, VPN segments, or poorly isolated internal systems could target unpatched installations of the WatchGuard Agent without significant barriers.
As of August 25, 2026, WatchGuard reported a lack of evidence indicating that these vulnerabilities have been actively exploited in the wild. However, they underscored that the absence of public exploitation should not lead organizations to delay necessary remediation efforts, especially since both vulnerabilities facilitate unauthentic code execution.
Call to Action for Organizations
To mitigate these risks, organizations are urged to upgrade their WatchGuard Agent to version 1.25.13.0000 or later. Specifically, for CVE-2026-57910, versions 1.17.02.0000 and 1.17.21.0000 contain necessary fixes, while the remediation for CVE-2026-57909 specifically requires updating to version 1.25.13.0000.
Security teams are advised to conduct comprehensive reviews of deployed WatchGuard Agent versions. Prioritizing systems that are exposed to public networks or that are internally reachable will help organizations minimize risk. Moreover, teams should maintain vigilance by monitoring for unusual patterns in UDP discovery traffic, unexpected TaskExecute activities, and any suspicious binary downloads or process launches from the WatchGuard Agent service.
In conclusion, given the potential seriousness of these vulnerabilities, proactive measures, including timely upgrades and monitoring, are essential steps toward safeguarding network integrity and protecting sensitive data from unauthorized access and exploitation.