Two Critical Vulnerabilities in WatchGuard Agent Allow SYSTEM-Level Code Execution
WatchGuard has disclosed two critical vulnerabilities in its Windows Agent, CVE-2026-57910 and CVE-2026-57909, enabling unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
WatchGuard has announced the discovery of two critical vulnerabilities affecting its Agent for Windows, versions prior to 1.25.13.0000. These flaws, identified as CVE-2026-57910 and CVE-2026-57909, pose a significant risk by allowing unauthenticated attackers to execute arbitrary code with the highest level of system privileges, known as SYSTEM.
CVE-2026-57910, rated with a CVSS v4.0 score of 9.3, is an improper authentication vulnerability. Attackers with network access can exploit the agent's UDP discovery and command service to trigger a TaskExecute event. This allows the vulnerable agent to download and execute malicious programs controlled by the attacker. Given that the WatchGuard Agent typically operates with elevated permissions, a successful exploit could grant an attacker complete control over the affected Windows systems.
Successful exploitation of CVE-2026-57910 could lead to the installation of malware, modification of security settings, establishment of persistence mechanisms, access to sensitive data, and lateral movement within an enterprise network. WatchGuard has linked this vulnerability to several weakness categories, including missing authentication for critical functions, improper cryptographic signature verification, and downloading code without integrity checks, indicating a severe lack of validation in the affected service.
The second vulnerability, CVE-2026-57909, carries a slightly higher CVSS v4.0 score of 9.4 and is classified as a path traversal vulnerability. This flaw enables an unauthenticated attacker on an adjacent network to execute arbitrary code on an affected WatchGuard Agent installation. The consequences of exploiting CVE-2026-57909 could include a complete loss of confidentiality, integrity, and availability for the endpoint protection component.
According to WatchGuard, this path traversal vulnerability arises from inadequate control over code generation and the absence of authentication for critical functionalities. This combination allows attackers to bypass security measures and remotely execute malicious code on targeted systems.
While WatchGuard stated it was unaware of any active exploitation in the wild at the time of disclosure, the severity and low attack complexity of these vulnerabilities necessitate prompt attention from organizations. The company strongly advises all users of the affected Windows Agent to upgrade to version 1.25.13.0000 or a later release to mitigate these risks.
Specific fixes are noted for different versions: CVE-2026-57910 is addressed in versions 1.17.02.0000 and 1.17.21.0000, while CVE-2026-57909 requires the update to version 1.25.13.0000. Security teams should prioritize identifying all WatchGuard Agent installations, verifying their current versions, and updating those exposed to untrusted or shared network segments. Until patching is complete, administrators can implement temporary mitigations by restricting access to the agent's UDP discovery and command service through network segmentation and firewall rules.
These vulnerabilities underscore the ongoing need for diligent patch management and network security hygiene, especially for endpoint security solutions that often operate with high privileges. Promptly addressing such flaws is crucial to prevent potential system compromise and maintain the integrity of an organization's security posture.