WatchGuard Agent CVE-2026-41286

Attacker must have adjacent network access (Layer 2 adjacency) to WatchGuard Agent endpoints, requiring presence on the same broadcast domain, VLAN, or subnet as protected systems. This typically requires prior network compromise, physical presence on-site, or access to guest/partner networks bridged to production segments. The vulnerable discovery service must be enabled and listening for network enrollment traffic. No authentication, user interaction, or elevated privileges required once network adjacency is achieved. Exploitation is NOT possible remotely across routed networks or via internet-facing attack surfaces. Windows platform specifically required (vulnerability does not affect non-Windows agent variants). Default WatchGuard Agent installations with discovery service enabled meet exploitation requirements without additional configuration changes.

Real-world risk is MODERATE despite the High CVSS score. The adjacent network attack vector (AV:A) significantly constrains the threat model compared to internet-exposed vulnerabilities - attackers require physical proximity or prior access to internal networks, VLAN segments, or guest WiFi where agents operate. Attack complexity is low (AC:L) with no user interaction (UI:N) or privileges (PR:N) required, making exploitation straightforward once network adjacency is achieved. However, the CVSS 4.0 vector shows VI:H (integrity impact) with no availability impact (VA:N), which contradicts the description stating the vulnerability allows crashing the service. This discrepancy requires vendor clarification: if the vulnerability truly enables only denial of service, the CVSS integrity metric may be incorrect; if integrity compromise is possible, remote code execution potential exists beyond the stated crash impact. No EPSS score provided, no CISA KEV listing, and no public POC identified, indicating limited observed exploitation activity. Priority depends on deployment context: organizations with WatchGuard Agents on sensitive network segments (finance, healthcare, industrial) should prioritize remediation, while those with strong network segmentation and limited adjacent network exposure face lower practical risk. The availability of a vendor advisory (WGSA-2026-00011) suggests patch availability, reducing remediation friction.

An attacker connected to the corporate network via compromised IoT device or rogue wireless access point identifies WatchGuard Agents via discovery service broadcast responses on the local subnet. The attacker crafts malicious discovery packets with oversized fields that trigger stack buffer overflow when processed by the agent service, causing service crash and potential denial of endpoint protection. In environments with automatic service restart, repeated exploitation could maintain persistent agent unavailability during critical security events.