WatchGuard Agent CVE-2026-6788

Requires authenticated access to a Windows system with WatchGuard Agent installed (PR:L in CVSS vector). The attacker must have write permissions to at least one directory that the WatchGuard Agent service searches during DLL loading-typically the service's working directory, the current user's directories if the service inherits them, or user-writable locations in the system PATH. The vulnerable agent version (before 1.25.03.0000) must be running as a Windows service with elevated privileges (SYSTEM or administrator context) for the privilege escalation to succeed. No special features need to be enabled or specific configurations required beyond default WatchGuard Agent installation. Exploitation is limited to local access scenarios-remote attackers must first achieve initial foothold through other means (phishing, RCE in another application) before leveraging this vulnerability for privilege escalation.

This vulnerability presents significant risk in enterprise environments where WatchGuard Agent is deployed for endpoint security. The CVSS 8.5 (High) score reflects complete compromise of confidentiality, integrity, and availability on the vulnerable system (VC:H/VI:H/VA:H), with no subsequent system impact (SC:N/SI:N/SA:N), indicating the compromise is contained to the local endpoint. Attack complexity is low (AC:L) and requires only standard user credentials (PR:L), making exploitation accessible to most internal threats or malware that has already achieved initial access. No EPSS or KEV data is provided, suggesting this has not been observed in widespread exploitation campaigns. However, DLL hijacking is a well-understood technique with numerous public tools available, making exploitation straightforward for adversaries. The primary risk multiplier is the agent's privileged service context-successful exploitation grants SYSTEM-level access from a low-privileged starting point. Organizations running pre-1.25.03.0000 versions should prioritize patching, particularly in high-security environments or where insider threat models include compromised standard user accounts.

An attacker with standard user credentials on a Windows workstation running vulnerable WatchGuard Agent identifies writable directories in the DLL search path. They compile or obtain a malicious DLL with the same name as a library loaded by the WatchGuard Agent service, then place it in a user-writable location checked before secure system directories. When the service next starts (system reboot, service restart, or scheduled task), it loads the attacker's DLL with SYSTEM privileges, executing arbitrary code that establishes persistence, disables security controls, or exfiltrates sensitive data. Public DLL hijacking tools and techniques are widely documented, lowering the skill barrier for exploitation.