EUVD-2026-27840
GHSA-m376-6rq6-f84p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) · only source for this CVE.
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
2DescriptionCVE.org
Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process.This issue affects WatchGuard Agent: before 1.25.03.0000.
AnalysisAI
Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious code into existing agent processes, achieving high-impact confidentiality, integrity, and availability compromise. WatchGuard Agent versions prior to 1.25.03.0000 are affected. CVSS v4.0 score of 8.5 reflects local attack vector with low complexity and low privilege requirements, though no active exploitation (KEV) or public POC has been identified at time of analysis. The vulnerability's CWE-321 classification indicates embedded cryptographic material that could be extracted and reused for process injection attacks.
Technical ContextAI
This vulnerability stems from CWE-321 (Use of Hard-coded Cryptographic Key), where cryptographic secrets are embedded directly in application binaries or configuration files rather than securely generated and stored. In the WatchGuard Agent context, hard-coded keys likely protect inter-process communication channels, code signing validation, or memory encryption mechanisms. An attacker who extracts these keys from the binary can bypass authentication controls that normally prevent unauthorized code injection into the agent's process space. The CVSS v4.0 vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component (VC:H/VI:H/VA:H) but no subsequent system impact (SC:N/SI:N/SA:N), suggesting the compromise remains contained within the agent process itself. The affected product runs exclusively on Windows platforms, narrowing the attack surface to Windows-based endpoints where WatchGuard Agent is deployed for endpoint protection, VPN enforcement, or network access control.
RemediationAI
Upgrade WatchGuard Agent for Windows to version 1.25.03.0000 or later, which addresses the hard-coded cryptographic key vulnerability according to WatchGuard security advisory WGSA-2026-00013 (https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013). Prioritize systems with higher concentrations of privileged users or sensitive data where local privilege escalation poses greater business risk. If immediate patching is not feasible, implement compensating controls: restrict local user privileges through least-privilege policies to limit PR:L attack prerequisite, enable application control solutions to block unauthorized code injection attempts into WatchGuard Agent processes (though this may interfere with legitimate agent functionality and requires testing), deploy endpoint detection and response (EDR) tools with behavioral monitoring for process injection patterns targeting security agents, and audit local administrator accounts to reduce attack surface. Note that these mitigations do not eliminate the root cause and may generate operational friction or false positives in EDR systems. Verify patch deployment through version checks post-installation and monitor WatchGuard logs for anomalous agent behavior during the update window.
Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a loca
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.
A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remot
Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with ele
A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macm
Local privilege escalation due to insecure driver communication port permissions. Rated high severity (CVSS 7.8), this v
Local privilege escalation vulnerability in Action1 where an attacker with low-privileged code execution can exploit an
Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulner
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from L
Local privilege escalation due to improper soft link handling. Rated high severity (CVSS 7.8), this vulnerability is low
Local privilege escalation due to unrestricted loading of unsigned libraries. Rated high severity (CVSS 7.8), this vulne
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today