EUVD-2026-27828
GHSA-5w53-ghhh-45v8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (WatchGuard) · only source for this CVE.
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
3DescriptionCVE.org
Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated attacker on the same local network could exploit this vulnerability to crash the agent service.
AnalysisAI
Stack-based buffer overflow in WatchGuard Agent's discovery service allows adjacent network attackers to crash the agent service without authentication. Affects Windows installations prior to version 1.25.03.0000. Vendor patch released addressing the vulnerability. SSVC framework indicates no active exploitation observed and manual exploitation required. While CVSS 7.1 (High) reflects network-adjacent access with high availability impact, actual risk is limited to denial-of-service - no code execution or data compromise possible per the CVSS vector (VC:N/VI:N/VA:H).
Technical ContextAI
The vulnerability exists in WatchGuard Agent's discovery service, which handles network-based agent identification and enumeration within enterprise environments. Stack-based buffer overflows (CWE-121) occur when input exceeding allocated stack buffer space overwrites adjacent memory regions, causing program crashes or potentially arbitrary code execution. In this case, the overflow occurs during processing of discovery service requests on the local network segment. The affected component cpe:2.3:a:watchguard:watchguard_agent runs on Windows endpoints to provide security policy enforcement and communication with WatchGuard management infrastructure. The CVSS 4.0 vector indicates adjacent network attack vector (AV:A), requiring the attacker to be on the same network broadcast domain as the vulnerable agent, with low attack complexity (AC:L) and no privileges required (PR:N).
RemediationAI
Upgrade WatchGuard Agent to version 1.25.03.0000 or later, which contains vendor-released patches addressing the stack buffer overflow. Download the patched version from WatchGuard's support portal or through your centralized agent management console. Refer to WatchGuard security advisory WGSA-2026-00010 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00010 for detailed upgrade instructions. If immediate patching is not feasible, implement network segmentation to isolate WatchGuard Agent endpoints from untrusted network segments - specifically restrict adjacent network access by placing agents in dedicated VLANs separated from guest/contractor networks. This reduces attack surface but creates operational complexity for legitimate agent discovery traffic. Firewall rules blocking unsolicited discovery service traffic from non-management subnets can provide additional defense-in-depth, though this may impact agent auto-discovery features requiring manual agent registration instead.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today