Loading story…
WatchGuard disclosed multiple vulnerabilities in WatchGuard Agent on Windows affecting version 1.25.02.0000 and earlier, including local privilege escalation flaws and stack-based buffer overflows in the Agent Discovery Service. The issues are tracked as CVE-2026-6787, CVE-2026-6788, CVE-2026-41288, CVE-2026-41286, and CVE-2026-41287, with one advisory describing a chained set of agent service weaknesses that can allow escalation to SYSTEM privileges.
Separate advisories also detail two buffer overflow variants in the Windows Agent Discovery Service that can trigger denial of service, expanding the impact beyond privilege abuse to service disruption. The Canadian Centre for Cyber Security echoed the vendor notice and urged organizations using affected WatchGuard Agent deployments to review the advisories and apply the vendor’s updates and mitigations.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-06, the Canadian Centre for Cyber Security published alert AV26-428 summarizing WatchGuard's disclosures. The notice urged users and administrators to review the vendor advisories and apply the necessary updates for CVE-2026-6787, CVE-2026-6788, CVE-2026-41288, CVE-2026-41286, and CVE-2026-41287.
On 2026-05-06, WatchGuard disclosed multiple vulnerabilities affecting WatchGuard Agent on Windows 1.25.02.0000 and earlier. The advisories covered local privilege escalation flaws, including a chained service issue that could lead to SYSTEM privileges, and two stack-based buffer overflow denial-of-service variants in the Agent Discovery Service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyber.gc.ca
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourcewatchguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard patched two critical vulnerabilities in its Windows WatchGuard Agent that allow unauthenticated remote code execution: `CVE-2026-57909` (CVSSv4 9.4) and `CVE-2026-57910` (CVSSv4 9.3). `CVE-2026-57909` is a path-traversal flaw exploitable by an attacker on an adjacent network, while `CVE-2026-57910` stems from improper authentication in the agent's UDP discovery and command service. An attacker exploiting `CVE-2026-57910` can invoke the `TaskExecute` handler to make an affected agent download and run an attacker-controlled program with elevated, potentially `SYSTEM`, privileges. All Windows Agent releases before version `1.25.13.0000` are affected; organizations should upgrade to `1.25.13.0000` or later. WatchGuard reported no known active exploitation or public proof-of-concept at disclosure.
Aug 27, 2026
WatchGuard issued advisories for a **local privilege-escalation** flaw in *Mobile VPN with IPSec* for Windows (third-party NCP-based client), tracked as **WGSA-2026-00002 / NCPVE-2025-0626**. During installation, update, or uninstallation, the MSI process can spawn `cmd.exe` windows running as **SYSTEM**; on some/older Windows configurations these prompts may be interactive, enabling a local user to hijack the process and execute arbitrary commands with **SYSTEM-level** privileges. The issue is scored **CVSS 6.3 (Medium)** but can result in full host compromise; guidance indicates affected users should update the client (reported as vulnerable up to **v15.19**) to a fixed release (reported as **v15.33**). In a separate WatchGuard advisory, the company also addressed an **LDAP injection** vulnerability in **Fireware OS** on *Firebox* appliances, tracked as **CVE-2026-1498** with a reported **CVSS 7.0**. The flaw is described as residing in the authentication interface and could allow a remote, unauthenticated attacker to manipulate LDAP queries, potentially exposing or extracting sensitive data from authentication backends; organizations running Firebox devices were advised to apply the relevant Fireware OS updates to mitigate the risk.
Jun 29, 2026
WatchGuard disclosed two high-severity vulnerabilities in **Fireware OS** affecting Firebox appliances, including a path traversal flaw in the **Web UI** tracked as `CVE-2026-3987` and an insecure deserialization issue in the **Access Portal** tracked as `CVE-2026-4266`. The Web UI bug can let a privileged, authenticated remote attacker perform an arbitrary file write and potentially execute code in the context of an elevated system process. The Access Portal flaw can lead to arbitrary code execution as the `portald` user through insecure deserialization. The issues affect multiple Fireware OS release lines, with `CVE-2026-3987` impacting versions `12.6.1` through `12.11.8` and `2025.1` through `2026.1.2`, while `CVE-2026-4266` affects versions `12.1` through `12.11.8` and `2025.1` through `2026.1.2`. WatchGuard said the deserialization bug is not a standalone remote exploit and requires prior write access to the local filesystem, making it more relevant for post-compromise chaining. The vulnerabilities are mapped to `CWE-22` and `CWE-502`, respectively, and WatchGuard published vendor guidance including advisory `WGSA-2026-00009`; Firebox models without Access Portal support, such as the **T-15** and **T-35**, are not affected by the Access Portal issue.
Jul 3, 2026