Critical WatchGuard Agent for Windows Bug Lets Attackers Run Code

Key Takeaways

• WatchGuard has disclosed two critical vulnerabilities, CVE-2026-57909 and CVE-2026-57910, in its WatchGuard Agent for Windows.
• These flaws enable unauthenticated attackers to execute arbitrary code with elevated privileges.
• Affected versions include WatchGuard Agent prior to 1.25.13.0000.
• Patches are available, and immediate updates are strongly recommended due to the high severity and low attack complexity.

Critical Flaws Discovered in WatchGuard Agent for Windows

WatchGuard has issued an urgent alert concerning two critical vulnerabilities within its Windows-based WatchGuard Agent. These security defects could empower unauthenticated attackers to achieve arbitrary code execution with elevated system privileges, posing a significant risk to affected organizations.

The identified vulnerabilities, cataloged as CVE-2026-57910 and CVE-2026-57909, impact all WatchGuard Agent versions predating 1.25.13.0000. The company made these disclosures on August 25, 2026. While WatchGuard has indicated no current evidence of in-the-wild exploitation for either flaw, the critical nature and ease of exploitation necessitate immediate patching for all organizations utilizing the affected endpoint protection component.

Improper Authentication Leads to Remote Code Execution (CVE-2026-57910)

The first vulnerability, CVE-2026-57910, has been assigned a CVSS v4.0 score of 9.3, classifying it as an improper authentication flaw. An unauthenticated attacker, with network access to a vulnerable system, could exploit the agent’s UDP discovery and command service. This exploit targets the TaskExecute event handler, forcing the agent to download and execute malicious, attacker-controlled software.

Given that the WatchGuard Agent typically operates with SYSTEM-level permissions on Windows environments, successful exploitation of this vulnerability would grant an attacker full control over the compromised system. This level of access facilitates a wide range of malicious activities, including malware deployment, security configuration manipulation, establishment of persistent access, exfiltration of sensitive data, and lateral movement across the network.

WatchGuard attributes CVE-2026-57910 to several underlying weaknesses, specifically citing a lack of authentication for critical functions, insufficient verification of cryptographic signatures, and the absence of integrity checks during code downloads. This combination suggests that the vulnerable service failed to adequately validate both the requesting entity and the integrity of the program it was instructed to retrieve and execute.

Path Traversal Vulnerability Allows Arbitrary Code Execution (CVE-2026-57909)

The second critical flaw, CVE-2026-57909, carries an even higher CVSS v4.0 score of 9.4. This path traversal vulnerability enables an unauthenticated attacker, operating on an adjacent network, to execute arbitrary code on an affected WatchGuard Agent installation. According to WatchGuard, successful exploitation of CVE-2026-57909 could lead to a complete compromise of the confidentiality, integrity, and availability of the endpoint protection component.

This vulnerability stems from inadequate controls over code generation and a lack of authentication for critical functionalities. These deficiencies create a pathway for attackers to bypass existing security measures and execute malicious code remotely on the system.

What You Should Do

• Update Immediately: Organizations must upgrade all affected WatchGuard Agent installations on Windows to version 1.25.13.0000 or later. WatchGuard also notes that versions 1.17.02.0000 and 1.17.21.0000 contain fixes for CVE-2026-57910, but CVE-2026-57909 specifically requires version 1.25.13.0000.
• Identify and Prioritize: Security teams should conduct an inventory of all WatchGuard Agent installations, verify their current versions, and prioritize updates, especially for systems exposed to untrusted or shared network segments.
• Implement Network Segmentation: Until patches can be fully deployed, administrators should restrict access to the agent’s UDP discovery and command service. This can be achieved through robust network segmentation and stringent firewall rules to minimize potential attack surface.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.