Reported by 2 outlets
Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 2.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code
gbhackers.com · 48d ago · August 26th, 2026
WatchGuard has revealed two critical vulnerabilities in its Windows WatchGuard Agent, which could allow unauthenticated attackers to execute arbitrary code on affected endpoints. These vulnerabilities, tracked as CVE-2026-57910 and CVE-2026-57909, have CVSS v4.0 scores of 9.3 and 9.4, respectively. Both issues impact WatchGuard Agent versions earlier than 1.25.13.0000. If exploited, these vulnerabilities could give an […] The post Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical WatchGuard Agent Flaws Let Remote Attackers Execute Arbitrary Code
cyberpress.org · 48d ago · August 26th, 2026
Both vulnerabilities were published on August 25, 2026. Although WatchGuard said it is not aware of exploitation in the wild, the issues create a serious exposure for organizations operating unpatched endpoint protection deployments. Critical WatchGuard Agent Flaws CVE-2026-57910 is an improper authentication vulnerability that enables an unauthenticated attacker with network access to force the WatchGuard Agent to execute attacker-controlled code with elevated privileges. According to WatchGuard, the attack abuses the agent’s UDP discovery and command service. An attacker can exploit the vulnerable TaskExecute event handler to instruct the agent to download and execute a malicious program. Because the agent often runs with elevated privileges, successful exploitation could grant root-level access on Linux systems or SYSTEM-level access on Windows endpoints. The vulnerability is classified under CWE-306, Missing Authentication for Critical Function. WatchGuard also associates it with CWE-347, Improper Verification of Cryptographic Signature, and CWE-494, Download of Code Without Integrity Check. This combination indicates t