EUVD-2026-27842
GHSA-j336-jmmp-f6w9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) · only source for this CVE.
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.This issue affects WatchGuard Agent before 1.25.03.0000.
AnalysisAI
Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with elevated system privileges through DLL hijacking. The agent searches for dependencies in user-controllable directories, enabling attackers with standard user credentials to plant malicious DLLs that load when the service starts. WatchGuard has released version 1.25.03.0000 to address this uncontrolled search path vulnerability (CWE-427).
Technical ContextAI
This vulnerability exploits CWE-427 (Uncontrolled Search Path Element), commonly manifested as DLL hijacking or binary planting on Windows systems. The WatchGuard Agent service searches for required libraries in directories that low-privilege users can write to, such as the current working directory or user-writable PATH locations. When the service loads, it executes code from these attacker-controlled libraries with SYSTEM privileges. This attack class relies on Windows' default DLL search order, which checks user-accessible locations before secure system directories. The CVSS 4.0 vector confirms local attack vector (AV:L), low complexity (AC:L), and requires only low privileges (PR:L) with no user interaction (UI:N), making it straightforward for local attackers to exploit once they have initial access to the system.
RemediationAI
Upgrade WatchGuard Agent to version 1.25.03.0000 or later as documented in WatchGuard security advisory WGSA-2026-00013 (https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013). Until patching is complete, implement the following compensating controls: restrict write permissions on all directories in the system PATH environment variable to administrators only, preventing standard users from placing malicious DLLs; enable Windows Attack Surface Reduction rules specifically blocking untrusted executable content from loading; configure WatchGuard Agent service to use a restricted working directory with administrator-only write access; monitor file creation events in common DLL search paths (current directory, Windows system directories) for unexpected library files. Note that disabling the agent itself eliminates the vulnerability but removes endpoint security protections, creating a different risk exposure that must be weighed against the exploitation likelihood in your environment.
Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a loca
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.
A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remot
Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious c
A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macm
Local privilege escalation due to insecure driver communication port permissions. Rated high severity (CVSS 7.8), this v
Local privilege escalation vulnerability in Action1 where an attacker with low-privileged code execution can exploit an
Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulner
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from L
Local privilege escalation due to improper soft link handling. Rated high severity (CVSS 7.8), this vulnerability is low
Local privilege escalation due to unrestricted loading of unsigned libraries. Rated high severity (CVSS 7.8), this vulne
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today