Which versions of WatchGuard Agent are affected by CVE-2026-41287?

WatchGuard Agent versions prior to 1.25.03.0000 contain a stack-based buffer overflow in the discovery service that allows network-adjacent attackers to crash the agent without authentication,…. A patch is available.

How to fix or mitigate CVE-2026-41287?

Within 24 hours: Inventory all WatchGuard Agent installations on Windows systems and identify those running versions prior to 1.25.03.0000. Within 7 days: Deploy vendor patch to version 1.25.03.0000 or later across all affected endpoints using your standard patch management process; prioritize internet-facing and critical infrastructure systems. Within 30 days: Verify 100% patch compliance through automated scanning and update documentation.

WatchGuard Agent CVE-2026-41287

Q: What is the CVSS score of CVE-2026-41287?

CVE-2026-41287 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27828 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-06 WatchGuard

GHSA-5w53-ghhh-45v8

Watchguard Stack Overflow Microsoft Buffer Overflow

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 17:00 vuln.today

Patch available

May 06, 2026 - 16:02 EUVD

CVSS changed

May 06, 2026 - 15:22 NVD

7.1 (HIGH)

DescriptionCVE.org

Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated attacker on the same local network could exploit this vulnerability to crash the agent service.

AnalysisAI

Stack-based buffer overflow in WatchGuard Agent's discovery service allows adjacent network attackers to crash the agent service without authentication. Affects Windows installations prior to version 1.25.03.0000. Vendor patch released addressing the vulnerability. SSVC framework indicates no active exploitation observed and manual exploitation required. While CVSS 7.1 (High) reflects network-adjacent access with high availability impact, actual risk is limited to denial-of-service - no code execution or data compromise possible per the CVSS vector (VC:N/VI:N/VA:H).

Technical ContextAI

The vulnerability exists in WatchGuard Agent's discovery service, which handles network-based agent identification and enumeration within enterprise environments. Stack-based buffer overflows (CWE-121) occur when input exceeding allocated stack buffer space overwrites adjacent memory regions, causing program crashes or potentially arbitrary code execution. In this case, the overflow occurs during processing of discovery service requests on the local network segment. The affected component cpe:2.3:a:watchguard:watchguard_agent runs on Windows endpoints to provide security policy enforcement and communication with WatchGuard management infrastructure. The CVSS 4.0 vector indicates adjacent network attack vector (AV:A), requiring the attacker to be on the same network broadcast domain as the vulnerable agent, with low attack complexity (AC:L) and no privileges required (PR:N).

RemediationAI

Upgrade WatchGuard Agent to version 1.25.03.0000 or later, which contains vendor-released patches addressing the stack buffer overflow. Download the patched version from WatchGuard's support portal or through your centralized agent management console. Refer to WatchGuard security advisory WGSA-2026-00010 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00010 for detailed upgrade instructions. If immediate patching is not feasible, implement network segmentation to isolate WatchGuard Agent endpoints from untrusted network segments - specifically restrict adjacent network access by placing agents in dedicated VLANs separated from guest/contractor networks. This reduces attack surface but creates operational complexity for legitimate agent discovery traffic. Firewall rules blocking unsolicited discovery service traffic from non-management subnets can provide additional defense-in-depth, though this may impact agent auto-discovery features requiring manual agent registration instead.