WatchGuard Agent Vulnerability

Overview

WatchGuard has disclosed two critical vulnerabilities in its Windows‑based WatchGuard Agent, tracked as CVE‑2026‑57910 and CVE‑2026‑57909. These flaws allow unauthenticated attackers to execute arbitrary code with SYSTEM‑level privileges, posing a severe risk to enterprise environments.

Vulnerability Details

• CVE‑2026‑57910
  • CVSS v4.0 score: 9.3.
  • Improper authentication flaw in the agent’s UDP discovery and command service.
  • Attackers can trigger the TaskExecute event handler, forcing the agent to download and run attacker‑controlled programs.
  • Exploitation leads to SYSTEM‑level code execution, enabling malware installation, persistence, and lateral movement.
• CVE‑2026‑57909
  • CVSS v4.0 score: 9.4.
  • Path traversal vulnerability allowing unauthenticated attackers on adjacent networks to execute arbitrary code.
  • Results in complete loss of confidentiality, integrity, and availability of the endpoint protection component.

Root Causes

• Missing authentication for critical functions.
• Improper cryptographic verification of downloaded code.
• Inadequate file handling and path traversal checks.

Impact

Successful exploitation could allow attackers to:

• Install malware.
• Alter security configurations.
• Create persistence mechanisms.
• Access sensitive files.
• Move laterally across enterprise networks.

Defensive Guidance

Organizations should:

• Upgrade immediately:
  • CVE‑2026‑57910 fixed in versions 1.17.02.0000 and 1.17.21.0000.
  • CVE‑2026‑57909 fixed in 1.25.13.0000.
• Identify vulnerable installations and confirm deployed versions.
• Segment networks: Limit exposure of the agent’s UDP discovery and command service.
• Apply firewall rules to restrict access until patching is complete.
• Monitor for anomalies such as unexpected downloads or privilege escalations.

Expert in the Cloud Insight

These vulnerabilities highlight how endpoint protection components themselves can become attack vectors when authentication and integrity checks are weak. Because the WatchGuard Agent runs with highly privileged permissions, exploitation could give attackers complete control of enterprise systems. The lesson is clear: patch endpoint agents as urgently as operating systems, and enforce network segmentation to reduce exposure.