WatchGuard Endpoint Security EUVD-2026-90898

Exploitation requires the attacker to already hold a local authenticated session (PR:L) on a host where the WatchGuard endpoint security product and its PSKMAD kernel driver are installed and loaded - i.e., a managed/protected endpoint, which is the product's default deployment mode. The specific technical precondition is the ability to open a handle to the PSKMAD driver and invoke its command interface; the vulnerability is that the driver fails to enforce its access-control handshake, so no special non-default configuration is needed once the driver is running. Limiting factors: no remote exploitation (AV:L), the attacker must first gain any valid local account, and exposure is confined to systems where the vulnerable driver version is deployed; no user interaction is required (UI:N).

This is a genuine high-priority local privilege/disclosure flaw, not an inflated high-CVSS paper risk, but its reach is bounded by requiring prior local authenticated access. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) consistently describes a locally-exploitable, low-privilege, no-interaction attack with high impact, which aligns cleanly with the CWE-306 missing-authentication description - the signals are internally consistent rather than conflicting. The key limiting signal is AV:L combined with PR:L: an attacker must already be an authenticated local user on the endpoint, so this is a privilege-escalation/sensitive-memory-disclosure primitive rather than a remotely wormable breach. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation - real-world urgency currently rests on severity and the sensitivity of kernel/process memory disclosure rather than on observed attacker use. One honest caveat: the description explicitly names only memory disclosure (a confidentiality outcome), yet the vendor rated VI:H/VA:H (integrity and availability) on the basis of 'arbitrary privileged commands'; this impact breadth is asserted by the vendor advisory but not fully detailed in the description, and should be verified against the WatchGuard PSIRT advisory.

An attacker who already has a low-privileged authenticated account on a Windows endpoint running WatchGuard endpoint security opens a handle to the PSKMAD kernel driver and skips the driver's access-control handshake, which is not enforced. They then issue privileged driver commands to read arbitrary kernel and other-process memory, harvesting credentials, tokens, or secrets to escalate privileges. No public exploit code was identified in the provided data, so exploitation would require custom tooling against the driver's IOCTL interface.