Which versions of WatchGuard Agent are affected by CVE-2026-41288?

CVE-2026-41288 is a privilege escalation vulnerability in WatchGuard Agent for Windows that allows authenticated local users to escalate to SYSTEM-level privileges, affecting organizations with…. A patch is available.

How to fix or mitigate CVE-2026-41288?

Within 24 hours: Inventory all Windows endpoints running WatchGuard Agent and document current versions in use. Within 7 days: Restrict local administrative account creation and enforce principle of least privilege for standard user accounts; implement application allowlisting or integrity monitoring on WatchGuard Agent installation directories. Within 30 days: Monitor WatchGuard security advisories for patch release and deploy immediately upon availability; test patch in non-production environment before full rollout.

WatchGuard Agent CVE-2026-41288

Q: What is the CVSS score of CVE-2026-41288?

CVE-2026-41288 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27836 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-06 5d1c2695-1a31-4499-88ae-e847036fd7e3

Microsoft Information Disclosure Watchguard

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 17:02 EUVD

Analysis Generated

May 06, 2026 - 16:31 vuln.today

DescriptionCVE.org

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.

AnalysisAI

Privilege escalation in WatchGuard Agent for Windows allows authenticated local users to gain NT AUTHORITY\SYSTEM privileges via incorrect permissions in the patch management component. CVSS 7.3 with low attack complexity and local attack vector. No active exploitation or public exploit code identified at time of analysis. EPSS data not available - real-world risk depends on defender endpoint deployment environments where local user access is already established.

Technical ContextAI

The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource) in the patch management module of WatchGuard Agent. Windows services and privileged components must enforce strict ACLs (Access Control Lists) on resources like files, registry keys, named pipes, or service control interfaces to prevent low-privileged users from manipulating them. When a SYSTEM-level service exposes writable resources to authenticated users without proper permission checks, attackers can inject malicious payloads, modify configuration, or trigger privileged operations. The WatchGuard Agent is an endpoint security and management client typically deployed on enterprise Windows systems to enforce firewall policies and system updates - making SYSTEM-level access a critical asset for attackers to disable protections or persist on managed endpoints.

RemediationAI

Apply the security update specified in WatchGuard PSIRT advisory WGSA-2026-00011 (https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00011). The advisory should provide the patched WatchGuard Agent version and deployment instructions via WatchGuard System Manager or manual installer. Until patching is complete, implement compensating controls: restrict local logon rights on systems running WatchGuard Agent to only essential administrative personnel using Group Policy 'Allow log on locally' settings (removes risk from standard users); enable Windows Event Log auditing for privilege-use events (Event ID 4672, 4673, 4674) to detect SYSTEM token acquisition attempts; monitor WatchGuard Agent process integrity and file system permissions on patch management directories for unexpected modifications. Note that restricting local logon may impact legitimate users on shared workstations or terminal servers - coordinate with IT support workflows before enforcement.