Which versions of WatchGuard Agent are affected by CVE-2026-41286?

CVE-2026-41286 affects WatchGuard Agent's discovery service on Windows, allowing unauthenticated adjacent network attackers to crash the agent through malformed network packets.. A patch is available.

How to fix or mitigate CVE-2026-41286?

Within 24 hours: Inventory all Windows systems running WatchGuard Agent and identify those on network segments with potential adjacent attackers (guest networks, IoT networks, or untrusted VLANs). Within 7 days: Isolate affected agents on high-risk network segments or implement network-level filtering to restrict discovery service traffic (UDP/TCP discovery ports) to trusted endpoints only. Within 30 days: Contact WatchGuard for patch availability timeline and deploy vendor-released patch to all WatchGuard Agent installations once available.

WatchGuard Agent CVE-2026-41286

Q: What is the CVSS score of CVE-2026-41286?

CVE-2026-41286 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27834 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-06 5d1c2695-1a31-4499-88ae-e847036fd7e3

Watchguard Stack Overflow Microsoft Buffer Overflow

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 17:02 EUVD

Analysis Generated

May 06, 2026 - 16:31 vuln.today

DescriptionCVE.org

Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated attacker on the same local network could exploit this vulnerability to crash the agent service.

AnalysisAI

Stack-based buffer overflow in WatchGuard Agent discovery service on Windows enables adjacent attackers without authentication to crash the agent via crafted network packets. CVSS 7.1 (High) reflects adjacent network attack vector with high integrity impact. The vulnerability targets the discovery service component used for agent enrollment and network communication. No CISA KEV listing or public exploit code identified at time of analysis, though the local network attack vector limits exposure to adjacent attackers.

Technical ContextAI

The vulnerability resides in WatchGuard Agent's discovery service, a Windows background service responsible for network-based agent enrollment and communication with WatchGuard security appliances. CWE-121 indicates a classic stack-based buffer overflow where unchecked input copied to a fixed-size stack buffer overwrites adjacent memory. The discovery service likely listens on a network port for enrollment broadcasts or service announcements. When processing specially crafted discovery packets, the service fails to validate input length before copying data into stack-allocated buffers. The CVSS 4.0 vector indicates adjacent network exposure (AV:A), meaning attackers must be on the same Layer 2 broadcast domain or VLAN. The VI:H (Vulnerable System Integrity High) rating with VC:N (no confidentiality impact) and VA:N (no availability impact) is unusual for a crash scenario, suggesting the buffer overflow may permit integrity compromise beyond simple denial of service, though exploitation difficulty or reliability constraints may limit actual RCE potential.

RemediationAI

Apply the security update detailed in WatchGuard Security Advisory WGSA-2026-00011 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00011). The advisory should specify patched agent versions and deployment procedures via WatchGuard Cloud management console or local update mechanisms. Until patching is complete, implement network segmentation to isolate WatchGuard Agents from untrusted network segments and restrict discovery service exposure using host-based firewalls to allow only trusted management traffic. Consider disabling the discovery service if agent enrollment is already complete and runtime discovery is not operationally required, though this may impact future agent mobility or re-enrollment workflows. Monitor Windows Event Logs and WatchGuard management console for unexpected agent service crashes or restarts as potential exploitation indicators. Note that network-level mitigations (VLANs, ACLs) reduce but do not eliminate risk if attackers achieve initial adjacent network access via other vectors like compromised devices or rogue access points.