Two critical security vulnerabilities have been identified in the WatchGuard Agent for Windows, posing a significant risk of unauthorized code execution with elevated privileges. The flaws, identified as CVE-2026-57910 and CVE-2026-57909, affect versions of the WatchGuard Agent prior to 1.25.13.0000, as revealed on August 25, 2026.
Details of the Vulnerabilities
Both vulnerabilities allow attackers to execute arbitrary code, with CVE-2026-57910 receiving a CVSS v4.0 score of 9.3. This score highlights an improper authentication issue that could let attackers misuse the agent’s UDP discovery and command service. This misuse could enable the TaskExecute event handler to trigger.
The vulnerability permits attackers to force the agent to download and run unauthorized programs, potentially leading to SYSTEM-level code execution on Windows. Such access could allow malicious actors to install malware, modify security settings, establish persistence, access confidential data, and further infiltrate network systems.
Impact and Exploitation Risks
WatchGuard has not reported any active exploitation of these vulnerabilities, yet their severity and ease of exploitation necessitate urgent action. The CVE-2026-57909 vulnerability, scoring 9.4 on the CVSS v4.0 scale, involves a path traversal issue. This flaw allows attackers on adjacent networks to execute arbitrary code on vulnerable installations.
The path traversal vulnerability arises from poor control over code generation and lack of critical function authentication, offering a route for attackers to bypass security measures. The outcome could be a total compromise of the endpoint protection system’s confidentiality, integrity, and availability.
Recommended Actions for Organizations
To mitigate these threats, organizations are advised to update their WatchGuard Agent to version 1.25.13.0000 or newer. Specific patches are available: versions 1.17.02.0000 and 1.17.21.0000 address CVE-2026-57910, while CVE-2026-57909 requires the latest update.
Security teams should audit all existing WatchGuard Agent installations, verify their versions, and prioritize updates, especially for systems exposed to potentially unsafe networks. Until patches are applied, restricting access to the agent’s UDP discovery and command service through network segmentation and firewall rules is recommended.
Ensuring swift updates and network adjustments can prevent potential security breaches, safeguarding organizational data and infrastructure from exploitation.
