The Security Agent Became the Remote Execution Service: WatchGuard Fixes Two Unauthenticated RCE Flaws
WatchGuard has fixed two critical flaws in its Windows endpoint agent. Both can lead to unauthenticated remote code execution, and the more broadly reachable flaw can make the trusted agent download and run an attacker-controlled program with SYSTEM privileges.
An endpoint security agent is supposed to reduce the attack surface. CVE-2026-57910 reverses that relationship. WatchGuard says an unauthenticated attacker with network access can abuse the agent’s UDP discovery and command service, invoke the TaskExecute event handler and make the endpoint download and execute an attacker-controlled program. On Windows, that code would typically run as SYSTEM.
A second flaw, CVE-2026-57909, combines path traversal and code injection to reach the same broad outcome. Its attack vector is narrower because the attacker must be on an adjacent network, but it still requires no credentials or user interaction.
Two flaws, two different network boundaries
| CVE | Impact and prerequisite | Affected and fixed versions | Exploitation and PoC status |
|---|---|---|---|
| CVE-2026-57909 CVSS 4.0: 9.4 | Unauthenticated arbitrary code execution through path traversal and code injection. The attacker must be on an adjacent network. No user interaction is required. | WatchGuard Agent for Windows before 1.25.13.0000. Update to 1.25.13.0000 or later. | WatchGuard reports no known exploitation. BlackTree found no credible public PoC, exploit module or detection template at the time of writing. |
| CVE-2026-57910 CVSS 4.0: 9.3 | Unauthenticated remote code execution with elevated privileges by abusing the UDP discovery and command service and its TaskExecute handler. Network access is required, but not an adjacent-network position. | The product-status table identifies versions before 1.25.13.0000 as affected. The advisory’s solution field also lists 1.17.02.0000 and 1.17.21.0000 as fixed branch releases. | WatchGuard reports no known exploitation. BlackTree found no credible public PoC, exploit module or detection template at the time of writing. |
Neither advisory provides a separate workaround. The practical remediation is to deploy a fixed WatchGuard Agent release and verify that every managed Windows endpoint has actually received it.
The trusted deployment channel is the attack path
CVE-2026-57910 is particularly consequential because the vulnerable feature exists to receive and execute management tasks. WatchGuard attributes the weakness to missing authentication, improper verification of cryptographic signatures and downloading code without adequately verifying its origin and integrity.
That combination removes several boundaries at once. The agent accepts a network command without establishing a trustworthy identity, retrieves a program chosen by the attacker and then runs it with the authority granted to the security product. The attacker does not need a separate privilege-escalation exploit because the legitimate agent supplies the privilege.
This is more than an ordinary service vulnerability. Security agents are widely deployed, centrally managed and intentionally privileged so they can inspect processes, files and network activity. Those same properties can make a compromised agent useful for disabling controls, moving laterally or delivering ransomware and data-theft tooling.
Adjacent does not mean harmless
The adjacent-network requirement for CVE-2026-57909 materially reduces direct Internet exposure, but it should not be read as a low-impact condition. An attacker may reach the required position through a compromised workstation, a shared wireless network, a poorly segmented VPN or another foothold on the same network segment.
Once that condition is satisfied, the flaw still needs no account and no action from the user of the protected endpoint. The agent turns a local-network foothold into arbitrary code execution on another system, which can shorten lateral movement inside an organisation.
The version guidance needs careful reading
WatchGuard’s product-status tables describe WatchGuard Agent for Windows releases before 1.25.13.0000 as affected and 1.25.13.0000 or later as not affected. NHS England repeats that baseline in its alert.
The CVE-2026-57910 advisory additionally lists 1.17.02.0000 and 1.17.21.0000 in its solution field. That appears to provide fixed releases for older branches, but the advisory does not explain the branch relationship in detail. Administrators should therefore confirm the supported channel for their environment rather than comparing only the apparent numerical order of the versions. For the current branch, 1.25.13.0000 is the clear fixed baseline.
What security teams should do now
- Inventory the agent itself. Use the management console and an independent endpoint inventory to identify every Windows system running WatchGuard Agent.
- Deploy a fixed release. Move current-channel systems to WatchGuard Agent 1.25.13.0000 or later. Confirm the appropriate fixed build with WatchGuard before retaining an older 1.17 branch.
- Verify installation, not assignment. A policy that schedules an update is not proof that a laptop, remote workstation or intermittently connected server received it.
- Restrict network reachability. Limit access to the agent’s discovery and command services to the management systems and network segments that require it. Review firewall and segmentation rules around user, wireless, VPN and server networks.
- Hunt for abnormal task activity. Review agent-management events, unexpected task execution, downloads initiated by the agent, new child processes and outbound connections to unfamiliar hosts.
- Watch for weaponisation. No malicious exploitation or credible public PoC was identified at publication time. A reproducible exploit, scanner or detection template would materially shorten the response window.
The larger security lesson
Privileged security software is part of the organisation’s trust infrastructure. Its update, discovery and command channels deserve the same threat modelling as remote-management tools because both can execute code across many endpoints.
The important question is not only whether an agent detects malicious software. It is whether the agent proves who issued a task, verifies what it is about to download and constrains where and how that code can run. In CVE-2026-57910, those controls failed together. The product intended to enforce trust became the path that bypassed it.
Sources and publication details
- WatchGuard PSIRT: CVE-2026-57909, published 25 August 2026 and updated 26 August 2026. The advisory provides dates but no publication or update times.
- WatchGuard PSIRT: CVE-2026-57910, published and updated 25 August 2026. The advisory provides a date but no time.
- NHS England Digital: WatchGuard releases security updates for critical vulnerabilities in WatchGuard Agent, published 26 August 2026 at 12:19 PM and last edited at 12:20 PM. The page does not display a timezone.
