CVE-2026-57909 and CVE-2026-57910 could allow unauthenticated remote code execution on affected WatchGuard Agent systems
CVE-2026-57909 and CVE-2026-57910 could allow unauthenticated remote code execution on affected WatchGuard Agent systems
The following platforms are known to be affected:
Security agents are attractive targets to attackers
Security agents are attractive targets to attackers because they are trusted, widely deployed, and often operate with elevated privileges. Exploitation of these vulnerabilities could enable an attacker to gain control of affected endpoints, evade security monitoring, move laterally within networks, and deploy follow-on activity such as ransomware or data theft.
WatchGuard has released two security advisories to address critical vulnerabilities in WatchGuard Agent. Successful exploitation could allow a remote attacker to execute arbitrary code on affected systems, potentially resulting in full system compromise.
Affected organisations are encouraged to review the WatchGuard Advisory for CVE-2026-57909 and WatchGuard advisory for CVE-2026-57910 and apply the relevant update as soon as possible.
A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
Last edited: 26 August 2026 12:20 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
