EUVD-2026-65438
GHSA-6c89-2v98-5qj2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach agent service over network
-
DeliverySend crafted unauthenticated request
-
ExploitBypass improper authentication check
-
ExecutionInvoke privileged agent function
-
PersistExecute arbitrary code with elevated privileges
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The required precondition is network access to a host running the WatchGuard Agent with its listening service reachable by the attacker (AV:N). Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), exploitation is unauthenticated, requires no user interaction, no special privileges, and no additional attack requirements or non-default configuration - the improper authentication flaw is exploitable against a reachable agent. The primary limiting factor is network reachability: agents that are firewalled, bound to loopback, or confined to a segmented management network are not exposed to arbitrary remote attackers, so exposure hinges on whether the agent's service is accessible from untrusted networks. |
| Impact | This is a genuine high priority rather than an inflated CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-practical combination for an internet- or LAN-reachable service: remote, low complexity, no attack requirements, no privileges, and no user interaction, with high impact across all three vulnerable-system dimensions (VC:H/VI:H/VA:H). Mitigating the urgency somewhat, there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, and no EPSS score was provided in the input, so the exploitation-probability signal is unknown; these are the main tempering factors. However, missing-authentication RCE flaws in security-agent software are historically attractive targets, so any organization running the WatchGuard Agent should treat remediation as urgent regardless of current in-the-wild activity. Scope is unchanged (SC/SI/SA:N), meaning impact is confined to the vulnerable host rather than propagating to other systems. |
| Exploit ScenarioDerived | An attacker with network reach to a host running the WatchGuard Agent sends a crafted request to the agent's exposed service, bypassing the missing authentication check and invoking a privileged function. Because the agent runs with elevated privileges and no user interaction is required, the request results in arbitrary code execution as a high-privilege account, giving the attacker full control of the host. No public proof-of-concept is currently identified, so exploitation would require independent development of the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Remote code execution in the WatchGuard Agent allows an unauthenticated attacker with network access to trigger arbitrary code execution at elevated privilege due to an improper authentication flaw (CWE-306). The CVSS 4.0 base score of 9.3 reflects a network-reachable, no-interaction, no-privilege attack yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth reachability and privileged code execution makes this a high-priority exposure.
RemediationAI
Patch available per vendor advisory: consult the WatchGuard PSIRT advisory at https://psirt.watchguard.com/CVE-2026-57910 and upgrade the WatchGuard Agent to the fixed version specified there (an exact fixed version was not included in the provided data and must be taken from the advisory). Until the patched build is deployed, restrict network reachability of the agent's listening service - apply host firewall rules or network ACLs so that only trusted management hosts/subnets can reach the agent's port, which directly removes the unauthenticated-network-access precondition at the cost of requiring accurate management-host inventory. Where feasible, isolate agent hosts on a segmented management VLAN and monitor for anomalous connections or unexpected privileged process spawns from the agent, accepting that segmentation adds operational overhead but sharply reduces exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The WatchGuard Agent is endpoint/management software distributed by WatchGuard (identified by CPE cpe:2.3:a:watchguard:watchguard_agent:*:*:*:*:*:*:*:*), typically deployed on endpoints or servers to communicate with WatchGuard security infrastructure. The root cause is classified as CWE-306, Missing Authentication for a Critical Function: a network-facing function that performs privileged operations does not properly verify the identity of the caller. Because the agent runs with elevated privileges, an authentication gap on its network interface lets an unauthenticated request reach a code-execution path, converting a missing-auth-check into full host compromise. The vendor's own tags corroborate this as an Authentication Bypass leading to RCE.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable missing-auth flaw (PR:N/AV:N/AC:L/UI:N) yielding privileged arbitrary code execution, so full C/I/A impact; scope unchanged as impact stays on the host.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
Executive ViewAI
A critical remote code execution vulnerability in WatchGuard Agent enables unauthenticated attackers to execute code with elevated privileges on any protected endpoint, effectively bypassing the organization's endpoint defense layer and enabling insider-level system compromise. This flaw exists in the security tool itself, transforming it into a direct attack vector for ransomware deployment, lateral movement, and data exfiltration across your organization. Immediate containment through network restrictions is essential while awaiting vendor patch availability.
Network segmentation and firewall rules to restrict WatchGuard Agent reachability from untrusted networks; deploy host-based firewalls (Windows Defender Firewall, iptables) blocking inbound connections to agent service ports; implement endpoint detection and response (EDR) solutions with behavioral analysis to detect exploitation attempts and privilege escalation; configure network intrusion detection/prevention systems (IDS/IPS) with signatures monitoring WatchGuard Agent compromise patterns; restrict administrative access to WatchGuard Agent systems and enforce multi-factor authentication for all privileged operations; consider temporary service disablement on non-critical systems pending patch validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Exploit-DB