Which versions of WatchGuard Agent are affected by EUVD-2026-27840?

WatchGuard Agent for Windows contains a hard-coded cryptographic key that allows local authenticated users to inject malicious code into agent processes, potentially compromising endpoint security…. A patch is available.

How to fix or mitigate EUVD-2026-27840?

Within 24 hours: Inventory all WatchGuard Agent for Windows installations and document current versions. Within 7 days: Contact WatchGuard support to confirm availability and timeline for patch 1.25.03.0000 or later; evaluate whether interim containment is feasible by restricting local administrative access on affected endpoints. Within 30 days: Deploy WatchGuard Agent version 1.25.03.0000 or later across all affected systems following change management procedures.

WatchGuard Agent EUVD-2026-27840

Q: What is the CVSS score of EUVD-2026-27840?

EUVD-2026-27840 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6787 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-05-06 5d1c2695-1a31-4499-88ae-e847036fd7e3

GHSA-m376-6rq6-f84p

Microsoft Information Disclosure Watchguard

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 17:02 EUVD

Analysis Generated

May 06, 2026 - 16:32 vuln.today

DescriptionCVE.org

Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process.This issue affects WatchGuard Agent: before 1.25.03.0000.

AnalysisAI

Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious code into existing agent processes, achieving high-impact confidentiality, integrity, and availability compromise. WatchGuard Agent versions prior to 1.25.03.0000 are affected. CVSS v4.0 score of 8.5 reflects local attack vector with low complexity and low privilege requirements, though no active exploitation (KEV) or public POC has been identified at time of analysis. The vulnerability's CWE-321 classification indicates embedded cryptographic material that could be extracted and reused for process injection attacks.

Technical ContextAI

This vulnerability stems from CWE-321 (Use of Hard-coded Cryptographic Key), where cryptographic secrets are embedded directly in application binaries or configuration files rather than securely generated and stored. In the WatchGuard Agent context, hard-coded keys likely protect inter-process communication channels, code signing validation, or memory encryption mechanisms. An attacker who extracts these keys from the binary can bypass authentication controls that normally prevent unauthorized code injection into the agent's process space. The CVSS v4.0 vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component (VC:H/VI:H/VA:H) but no subsequent system impact (SC:N/SI:N/SA:N), suggesting the compromise remains contained within the agent process itself. The affected product runs exclusively on Windows platforms, narrowing the attack surface to Windows-based endpoints where WatchGuard Agent is deployed for endpoint protection, VPN enforcement, or network access control.

RemediationAI

Upgrade WatchGuard Agent for Windows to version 1.25.03.0000 or later, which addresses the hard-coded cryptographic key vulnerability according to WatchGuard security advisory WGSA-2026-00013 (https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013). Prioritize systems with higher concentrations of privileged users or sensitive data where local privilege escalation poses greater business risk. If immediate patching is not feasible, implement compensating controls: restrict local user privileges through least-privilege policies to limit PR:L attack prerequisite, enable application control solutions to block unauthorized code injection attempts into WatchGuard Agent processes (though this may interfere with legitimate agent functionality and requires testing), deploy endpoint detection and response (EDR) tools with behavioral monitoring for process injection patterns targeting security agents, and audit local administrator accounts to reduce attack surface. Note that these mitigations do not eliminate the root cause and may generate operational friction or false positives in EDR systems. Verify patch deployment through version checks post-installation and monitor WatchGuard logs for anomalous agent behavior during the update window.