Which versions of WatchGuard Authentication Gateway are affected by CVE-2024-6593?

WatchGuard's Authentication Gateway (SSO Agent) contains a critical authorization bypass vulnerability (CVE-2024-6593) that allows unauthenticated remote attackers to invoke restricted management…

How to fix or mitigate CVE-2024-6593?

Within 24 hours, inventory all WatchGuard Authentication Gateway deployments running version 12.10.2 or earlier and restrict network access to affected systems from untrusted segments to minimize attack surface; simultaneously enable detailed logging and alerting for unauthorized management command attempts. Within 7 days, contact WatchGuard support to obtain interim mitigation guidance, implement recommended network segmentation and access control rules, and evaluate temporary deployment of additional authentication verification layers at the gateway. Within 30 days, establish monitoring for WatchGuard security advisories regarding patch availability; develop and validate a detailed upgrade plan to versions beyond 12.10.2 in non-production environments, and schedule production patching within your change management window.

WatchGuard Authentication Gateway CVE-2024-6593

Q: What is the CVSS score of CVE-2024-6593?

CVE-2024-6593 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Incorrect Authorization (CWE-863)

2024-09-25 5d1c2695-1a31-4499-88ae-e847036fd7e3

Authentication Bypass Microsoft Watchguard Authentication Gateway

9.3

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable agent with a broken authorization check gives PR:N/AC:L; executing restricted management commands yields high C and I, with no availability impact per vendor.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 08, 2026 - 00:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 08, 2026 - 00:22 vuln.today

cvss_changed

CVSS changed

Aug 08, 2026 - 00:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Sep 25, 2024 - 12:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. This issue affects Authentication Gateway: through 12.10.2.

AnalysisAI

Improper authorization in WatchGuard's Authentication Gateway (Single Sign-On Agent) on Windows lets a network-based attacker invoke restricted management commands that should be gated behind authorization checks, affecting all versions through 12.10.2. Per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, and requires no authentication or user interaction, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, though an independent RedTeam Pentesting advisory documenting the flaw exists; EPSS is a modest 0.52% (40th percentile), indicating no broad automated exploitation observed yet.

Technical ContextAI

The affected component is WatchGuard's Single Sign-On (SSO) Agent, also branded Authentication Gateway, a Windows-hosted service that ties firewall/network authentication to Windows domain identities so users are transparently authenticated to WatchGuard Firebox policies. The root cause is CWE-863 (Incorrect Authorization): the service accepts and acts on management commands over the network without correctly verifying that the requester is authorized to issue them. Rather than a missing authentication step entirely, the flaw is a broken authorization decision - the code performs a check that is present but incorrect, allowing restricted administrative operations to be reached by unauthorized network peers. The single affected CPE is cpe:2.3:a:watchguard:authentication_gateway:*, confirming the SSO Agent software (not the Firebox appliance firmware itself) as the vulnerable surface.

RemediationAI

Patch available per vendor advisory (WatchGuard PSIRT wgsa-2024-00015): upgrade the Authentication Gateway / Single Sign-On Agent to a WatchGuard-released version beyond 12.10.2 as directed by https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00015 and https://psirt.watchguard.com/CVE-2024-6593 - the exact fixed build should be confirmed against the advisory, as it is not specified in the available data. Until patched, restrict network reachability of the SSO Agent host so its management/listening ports are accessible only from trusted management stations and the Firebox itself: place the agent on an isolated administrative VLAN and apply host-based firewall rules limiting inbound connections to known-good source addresses, accepting the trade-off that overly tight rules can break SSO for legitimate user-authentication flows and must be validated against the agent's client population. Avoid any exposure of the SSO Agent to untrusted or internet-facing segments. Review the RedTeam Pentesting advisory (https://www.redteam-pentesting.de/advisories/rt-sa-2024-007) for exact affected command surfaces to prioritize monitoring.