Loading story…
WatchGuard patched two critical vulnerabilities in its Windows WatchGuard Agent that allow unauthenticated remote code execution: CVE-2026-57909 (CVSSv4 9.4) and CVE-2026-57910 (CVSSv4 9.3). CVE-2026-57909 is a path-traversal flaw exploitable by an attacker on an adjacent network, while CVE-2026-57910 stems from improper authentication in the agent's UDP discovery and command service.
An attacker exploiting CVE-2026-57910 can invoke the TaskExecute handler to make an affected agent download and run an attacker-controlled program with elevated, potentially SYSTEM, privileges. All Windows Agent releases before version 1.25.13.0000 are affected; organizations should upgrade to 1.25.13.0000 or later. WatchGuard reported no known active exploitation or public proof-of-concept at disclosure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
At the time of the August 25 disclosure, WatchGuard said it was not aware of either CVE-2026-57909 or CVE-2026-57910 being exploited in the wild. No public proof-of-concept exploit was reported.
On August 25, 2026, WatchGuard disclosed CVE-2026-57909 and CVE-2026-57910, two critical unauthenticated remote-code-execution vulnerabilities affecting Windows WatchGuard Agent versions before 1.25.13.0000. It released version 1.25.13.0000 to remediate both flaws, and also identified versions 1.17.02.0000 and 1.17.21.0000 as fixes for CVE-2026-57910.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard disclosed multiple vulnerabilities in **WatchGuard Agent on Windows** affecting version `1.25.02.0000` and earlier, including local privilege escalation flaws and stack-based buffer overflows in the Agent Discovery Service. The issues are tracked as `CVE-2026-6787`, `CVE-2026-6788`, `CVE-2026-41288`, `CVE-2026-41286`, and `CVE-2026-41287`, with one advisory describing a chained set of agent service weaknesses that can allow escalation to **SYSTEM** privileges. Separate advisories also detail two buffer overflow variants in the Windows Agent Discovery Service that can trigger **denial of service**, expanding the impact beyond privilege abuse to service disruption. The Canadian Centre for Cyber Security echoed the vendor notice and urged organizations using affected WatchGuard Agent deployments to review the advisories and apply the vendor’s updates and mitigations.
Jun 29, 2026
WatchGuard disclosed three vulnerabilities affecting WatchGuard AP firmware versions `1.0` through `3.4.7`, including two critical unauthenticated flaws: `CVE-2026-86102` and `CVE-2026-101891`. Both carry a CVSS v4 score of 9.3 and can allow a network-based attacker to bypass authentication or execute arbitrary operating-system commands through exposed internal API functionality. A third issue, `CVE-2026-87969` (CVSS 8.6), enables authenticated administrators to inject and execute OS commands through crafted diagnostic command-line input. WatchGuard fixed all three vulnerabilities in firmware version `3.4.8`. The company reported no known in-the-wild exploitation or public proof of concept at disclosure, but the unauthenticated network-reachable attack paths make unpatched APs high-risk. Organizations should immediately upgrade affected devices, restrict AP management and API interfaces to trusted administrative networks, and review logs and administrator credentials for signs of unauthorized access.
Sep 29, 2026
WatchGuard released fixes for five **critical** vulnerabilities in Fireware OS and WatchGuard Dimension, all rated CVSS v4 9.3. Three flaws in the internet-exposed `iked` IKE/VPN daemon—including the pre-authentication stack buffer overflow tracked as `CVE-2026-19318`—could allow unauthenticated attackers to execute code by sending crafted VPN traffic, creating a direct perimeter-compromise risk. A fourth Fireware issue affects the deprecated Mobile Security `epm` service, while a WatchGuard Dimension vulnerability could let a low-privileged administrator hijack a Super Administrator session. WatchGuard reported no confirmed exploitation or public proof-of-concept code, but organizations should apply the available updates immediately; where patching is delayed, VPN and management interfaces should be limited to trusted networks.
Sep 1, 2026