WatchGuard Advisory for CVE-2026-57909

psirt.watchguard.com • August 26, 2026

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

Impact: Successful exploitation could allow an unauthenticated attacker to achieve remote code execution, resulting in complete loss of confidentiality, integrity, and availability of the affected endpoint protection component.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Agent Enable Remote Code Execution Two critical vulnerabilities, CVE-2026-57909 and CVE-2026-57910, have been identified in WatchGuard Agent versions prior to 1.25.13.0000. These flaws allow unauthenticated remote code execution, potentially compromising affected systems. The vulnerabilities exploit improper authentication and path traversal, enabling attackers to execute arbitrary code with elevated privileges. WatchGuard has issued advisories urging affected organizations to apply updates immediately. The vulnerabilities are particularly concerning due to the elevated privileges of the WatchGuard Agent, which is widely deployed across various platforms. The CVSS scores for these vulnerabilities are 9.3 and 9.4, indicating a high level of severity. Organizations using the WatchGuard Agent are at risk of significant security breaches, including ransomware and data theft. As of now, exploitation in the wild has been confirmed, necessitating urgent action from security teams. 9 sources 73

Extracted Entities

WatchGuard Advisory for CVE-2026-57909

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)