Which versions of WatchGuard Agent are affected by EUVD-2026-27842?

WatchGuard Agent for Windows versions prior to 1.25.03.0000 contain a local privilege escalation vulnerability allowing authenticated standard users to execute arbitrary code with system privileges…. A patch is available.

How to fix or mitigate EUVD-2026-27842?

Within 24 hours: Inventory all systems running WatchGuard Agent for Windows and document current versions. Within 7 days: Upgrade all WatchGuard Agent instances to version 1.25.03.0000 or later across all endpoints. Within 30 days: Validate upgrade completion via endpoint management tools and implement application whitelisting or DLL search path policies to prevent future DLL hijacking attacks.

WatchGuard Agent EUVD-2026-27842

Q: What is the CVSS score of EUVD-2026-27842?

EUVD-2026-27842 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6788 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-05-06 5d1c2695-1a31-4499-88ae-e847036fd7e3

GHSA-j336-jmmp-f6w9

Microsoft Information Disclosure Watchguard

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 17:02 EUVD

Analysis Generated

May 06, 2026 - 16:32 vuln.today

DescriptionCVE.org

Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.This issue affects WatchGuard Agent before 1.25.03.0000.

AnalysisAI

Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with elevated system privileges through DLL hijacking. The agent searches for dependencies in user-controllable directories, enabling attackers with standard user credentials to plant malicious DLLs that load when the service starts. WatchGuard has released version 1.25.03.0000 to address this uncontrolled search path vulnerability (CWE-427).

Technical ContextAI

This vulnerability exploits CWE-427 (Uncontrolled Search Path Element), commonly manifested as DLL hijacking or binary planting on Windows systems. The WatchGuard Agent service searches for required libraries in directories that low-privilege users can write to, such as the current working directory or user-writable PATH locations. When the service loads, it executes code from these attacker-controlled libraries with SYSTEM privileges. This attack class relies on Windows' default DLL search order, which checks user-accessible locations before secure system directories. The CVSS 4.0 vector confirms local attack vector (AV:L), low complexity (AC:L), and requires only low privileges (PR:L) with no user interaction (UI:N), making it straightforward for local attackers to exploit once they have initial access to the system.

RemediationAI

Upgrade WatchGuard Agent to version 1.25.03.0000 or later as documented in WatchGuard security advisory WGSA-2026-00013 (https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013). Until patching is complete, implement the following compensating controls: restrict write permissions on all directories in the system PATH environment variable to administrators only, preventing standard users from placing malicious DLLs; enable Windows Attack Surface Reduction rules specifically blocking untrusted executable content from loading; configure WatchGuard Agent service to use a restricted working directory with administrator-only write access; monitor file creation events in common DLL search paths (current directory, Windows system directories) for unexpected library files. Note that disabling the agent itself eliminates the vulnerability but removes endpoint security protections, creating a different risk exposure that must be weighed against the exploitation likelihood in your environment.