WatchGuard advisory for CVE-2026-57910

psirt.watchguard.com • August 26, 2026

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

Impact: An unauthenticated remote attacker can execute arbitrary code on a host running WatchGuard Agent, typically with root or SYSTEM privileges, by abusing the UDP discovery/command service and the TaskExecute event handler to download and run an attacker-controlled program.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WatchGuard Agent Enable Remote Code Execution Two critical vulnerabilities, CVE-2026-57909 and CVE-2026-57910, have been identified in WatchGuard Agent versions prior to 1.25.13.0000. These flaws allow unauthenticated remote code execution, potentially compromising affected systems. The vulnerabilities exploit improper authentication and path traversal, enabling attackers to execute arbitrary code with elevated privileges. WatchGuard has issued advisories urging affected organizations to apply updates immediately. The vulnerabilities are particularly concerning due to the elevated privileges of the WatchGuard Agent, which is widely deployed across various platforms. The CVSS scores for these vulnerabilities are 9.3 and 9.4, indicating a high level of severity. Organizations using the WatchGuard Agent are at risk of significant security breaches, including ransomware and data theft. As of now, exploitation in the wild has been confirmed, necessitating urgent action from security teams. 4 sources 73

Extracted Entities

WatchGuard advisory for CVE-2026-57910

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)