Threat reportVulnerabilityTL-2026-2162
Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910, CVE-2026-57909) Enable Unauthenticated SYSTEM-Level RCE
Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910 (TL-2026-2162) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-08-27 and last reviewed 2026-08-30. It has no confirmed attribution, affects WatchGuard Technologies WatchGuard Agent for Windows, references 2 CVEs (CVE-2026-57910, CVE-2026-57909), maps to 16 MITRE ATT&CK techniques (T1005, T1046, T1068), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-2162
- Threat ID
- TL-2026-2162
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-08-30 · revalidated 1× · latest source
How Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910 works
WatchGuard disclosed two critical vulnerabilities in WatchGuard Agent for Windows versions earlier than 1.25.13.0000: an improper-authentication flaw in the UDP discovery/command service (CVE-2026-57910, CVSS v4.0 9.3) that lets an unauthenticated network attacker abuse the agent's TaskExecute event handler to download and execute an attacker-controlled program, and a path-traversal flaw (CVE-2026-57909, CVSS v4.0 9.4) reachable from an adjacent network that lets a malicious process drop an unauthorized executable. Both yield arbitrary code execution with SYSTEM privileges on an endpoint-security agent with a broad enterprise install base.
On 2026-08-25 WatchGuard's PSIRT disclosed CVE-2026-57910 and CVE-2026-57909, two critical vulnerabilities in WatchGuard Agent for Windows versions prior to 1.25.13.0000, documented in security advisory WGSA-2026-00012 ('WatchGuard Agent on Windows Privilege Escalation Vulnerability').
CVE-2026-57910 (CVSS v4.0 9.3, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is an improper-authentication weakness (CWE-306) in the agent's UDP discovery and command service. An unauthenticated attacker with network access can abuse this service to trigger the agent's TaskExecute event handler, instructing the agent to download and execute an attacker-controlled program. Two additional weaknesses compound the flaw: the agent does not correctly verify a cryptographic signature on the fetched payload before running it (CWE-347), and it downloads code without an integrity check (CWE-494). WatchGuard's own PSIRT record maps CVE-2026-57910 to both CAPEC-115 (Authentication Bypass) and CAPEC-242 (Code Injection). NVD's Stakeholder-Specific Vulnerability Categorization (SSVC) for the CVE rates exploitation status as 'none' (no observed in-the-wild activity), automatable as 'yes' (the exploitation steps can be scripted/scaled without human tailoring), and technical impact as 'total' (full loss of confidentiality, integrity, and availability of the affected component). Because the WatchGuard Agent service runs with elevated (SYSTEM) privileges on Windows, the net effect is unauthenticated, network-reachable, SYSTEM-level code execution requiring no user interaction.
CVE-2026-57909 (CVSS v4.0 9.4, CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is a path-traversal flaw (CWE-94, with the same missing-authentication root cause, CWE-306) that lets a malicious process on an adjacent network segment drop an unauthorized executable file onto the host outside the directory the agent intended, again resulting in arbitrary code execution with SYSTEM privileges. Its CVSS vector requires Adjacent Network (AV:A) rather than the unrestricted Network (AV:N) access of CVE-2026-57910, but scores slightly higher (9.4 vs 9.3) because NVD/WatchGuard also record subsequent-system impact (SC:H/SI:H/SA:H) — successful exploitation can propagate beyond the initially compromised host. Independent technical write-ups characterize the adjacency requirement as reducing pure internet-facing exposure while remaining significant in enterprise settings, since an attacker can reach an adjacent segment via a compromised endpoint, a rogue/compromised Wi-Fi or VPN access point, or prior lateral movement.
WatchGuard states it is not aware of either vulnerability being exploited in the wild as of the 2026-08-25 disclosure date, and CVE-2026-57910/57909 do not appear in CISA's Known Exploited Vulnerabilities catalog as of 2026-08-26. No public proof-of-concept or discoverer credit was found for CVE-2026-57910; CVE-2026-57909 is credited to researcher 'R31nfinder' per WatchGuard's PSIRT page. WatchGuard Agent for Windows 1.25.13.0000 (released 2026-08-19) resolves both issues; for CVE-2026-57910 only, the legacy branches 1.17.02.0000 and 1.17.21.0000 are also listed as fixed. Because the WatchGuard Agent is itself an endpoint-security product running with SYSTEM privileges and a broad enterprise footprint, an attacker who reaches the vulnerable UDP service on an unpatched host can achieve full host compromise (malware installation, persistence, tampering with the security agent's own protective configuration, credential/file access, and a foothold for lateral movement) without any authentication step. Independent security-media analysis published alongside the advisories converges on the same monitoring guidance: watch for unusual UDP discovery-service traffic, unexpected TaskExecute event-handler activity, and suspicious/unsigned binary downloads or file drops performed by the WatchGuard Agent process outside its expected install directories.
MITRE ATT&CK techniques used in TL-2026-2162
Collection
Discovery
T1046 Network Service Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Persistence
T1543.003 Create or Modify System Process
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Defense Evasion
T1553.002 Subvert Trust Controls; T1562.001 Impair Defenses
Execution
T1569 System Services; T1569.002 System Services
Resource Development
T1587.001 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
- WatchGuard Technologies — WatchGuard Agent for Windows
Vulnerable versions: 0 through 1.25.12.9999 (all versions prior to 1.25.13.0000)
Fixed in: 1.25.13.0000; 1.17.02.0000 (CVE-2026-57910 only); 1.17.21.0000 (CVE-2026-57910 only)
Remediation for Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
Patches
- WatchGuard Agent for Windows 1.25.13.0000 (resolves both CVE-2026-57910 and CVE-2026-57909)
- WatchGuard Agent 1.17.02.0000 / 1.17.21.0000 (legacy-branch fixes for CVE-2026-57910 only, per WatchGuard PSIRT)
Immediate actions
- Upgrade WatchGuard Agent for Windows to version 1.25.13.0000 or later on all managed endpoints
- Restrict network reachability of the WatchGuard Agent UDP discovery/command service from untrusted, general-user, or guest network segments until patched
- Inventory and prioritize patching of any endpoints still running versions prior to 1.25.13.0000 (or, for CVE-2026-57910 only, prior to the 1.17.02.0000 / 1.17.21.0000 legacy fixes)
Longer-term hardening
- Segment endpoint-security-agent management/discovery traffic away from general workstation, guest, and adjacent-network segments
- Monitor WatchGuard Agent processes for unusual UDP discovery-service traffic, unexpected TaskExecute event-handler activity, unsigned-binary execution, or unexpected file writes/drops consistent with TaskExecute abuse or path-traversal file drops
- Establish an accelerated patch-management SLA for security-agent software given its SYSTEM-level privileges and network-facing service surface
CVEs associated with Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
Weaknesses (CWE) in Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
Timeline of Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
- Canadian Centre for Cyber Security (CCCS) published advisory AV26-428 covering earlier WatchGuard Agent for Windows vulnerabilities — CVE-2026-6787/CVE-2026-6788 (chained local privilege escalation to SYSTEM), CVE-2026-41288 (privilege escalation), and CVE-2026-41286/CVE-2026-41287 (Discovery Service stack-based buffer overflow, DoS) — in versions at or below 1.25.02.0000, establishing a recurring pattern of authentication/input-validation weaknesses in the agent's discovery/management components.
- WatchGuard released Agent v1.17.21.0000; the release notes describe it as remediating the same underlying issue as CVE-2026-57909, while WatchGuard's PSIRT page for CVE-2026-57910 separately lists this build among that CVE's fixed versions.
- WatchGuard released WatchGuard Agent for Windows v1.25.13.0000, resolving both CVE-2026-57910 (improper authentication in the UDP discovery/command service) and CVE-2026-57909 (path traversal).
- WatchGuard published security advisory WGSA-2026-00012, 'WatchGuard Agent on Windows Privilege Escalation Vulnerability,' covering both CVEs; WatchGuard stated it was not aware of exploitation in the wild for either issue.
- CVE-2026-57910 (CVSS v4.0 9.3) and CVE-2026-57909 (CVSS v4.0 9.4) were published via WatchGuard's PSIRT and received by NVD, each mapped to CAPEC-115 (Authentication Bypass); CVE-2026-57910 additionally mapped to CAPEC-242 (Code Injection).
- NHS England Digital issued cyber alert cc-4836 pointing UK healthcare organizations running WatchGuard-managed endpoints to the WatchGuard patches for CVE-2026-57910/CVE-2026-57909.
- Security-media outlets (gbhackers.com, cyberpress.org, cybersecuritynews.com) published independent technical write-ups reiterating the vendor's technical description and adding monitoring guidance (unusual UDP discovery-service traffic, unexpected TaskExecute activity, suspicious binary downloads).
- NVD's last-modified timestamp and WatchGuard's PSIRT page for CVE-2026-57909 were updated; the CVEs did not appear in CISA's Known Exploited Vulnerabilities catalog as of this date.
- Cyber Security News published further coverage of the two vulnerabilities, which triggered ingestion of this threat into the intel pipeline.
- NVD last-modified the CVE-2026-57910 record with finalized CVSS v4.0 scoring and CWE classification (CWE-306, CWE-347, CWE-494).
- CTO at NCSC's weekly summary (week ending 2026-08-30) listed WatchGuard Agent CVE-2026-57910 in its Exploitation section, surfacing this update-trigger report to the harness's RSS hunt pipeline; WatchGuard's advisory continues to state no in-the-wild exploitation has been observed.
Update history for TL-2026-2162
- 2026-08-30 — WatchGuard Agent Improper Authentication Enables Unauthenticated Remote Code Execution (CVE-2026-57910): What changed Severity, exploitability, status, and CVSS remain unchanged (CRITICAL / THEORETICAL / ACTIVE; existing 9.4 for CVE-2026-57909 already exceeds the new report's 9.3 for CVE-2026-57910, so no cvss_score change). What changed is sc
Sources cited for Critical WatchGuard Agent for Windows Flaws (CVE-2026-57910
- WatchGuard PSIRT — CVE-2026-57910 (Improper Authentication)
- WatchGuard PSIRT — CVE-2026-57909 (Path Traversal)
- WatchGuard Agent on Windows Privilege Escalation Vulnerability (WGSA-2026-00012)
- NVD — CVE-2026-57910
- NVD — CVE-2026-57909
- Critical WatchGuard Agent for Windows Vulnerability Let Attackers Execute Remote Code
- WatchGuard Agent Vulnerabilities Let Attackers Grant Full SYSTEM Privileges on Windows
- Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code
- Critical WatchGuard Agent Flaws Let Remote Attackers Execute Arbitrary Code
- WatchGuard Agent Releases (release notes)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-2162
As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2162 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.