Digital.Nhs.Uk Critical Vulnerabilities in WatchGuard Agent Enable Remote Code Execution
Article Content
- •CVE-2026-57909 and CVE-2026-57910 allow remote code execution on WatchGuard Agent systems.
- •Affected versions are all prior to 1.25.13.0000, with CVSS scores of 9.3 and 9.4.
- •Immediate updates are recommended to mitigate the risk of exploitation.
Two critical vulnerabilities, CVE-2026-57909 and CVE-2026-57910, have been identified in WatchGuard Agent versions prior to 1.25.13.0000. These flaws allow unauthenticated remote code execution, potentially compromising affected systems. The vulnerabilities exploit improper authentication and path traversal, enabling attackers to execute arbitrary code with elevated privileges. WatchGuard has issued advisories urging affected organizations to apply updates immediately. The vulnerabilities are particularly concerning due to the elevated privileges of the WatchGuard Agent, which is widely deployed across various platforms. The CVSS scores for these vulnerabilities are 9.3 and 9.4, indicating a high level of severity. Organizations using the WatchGuard Agent are at risk of significant security breaches, including ransomware and data theft. As of now, exploitation in the wild has been confirmed, necessitating urgent action from security teams.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (9)
Following this threat?
Track WatchGuard and CVE-2026-57909 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…