Read the docs
TI-2026-41690 Aliases CVE-2026-57910GHSA-6c89-2v98-5qj2

WatchGuard Agent improper authentication allows unauthenticated remote code execution

Priority MEDIUM 48CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-494.

Summary

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed WatchGuard Agent (WatchGuard): 1.17.01.0000, 1.25.13.0000, 1.17.21.0000

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WatchGuardWatchGuard Agentbefore 1.17.01.00001.17.01.0000Patch availableCNA
WatchGuardWatchGuard Agentbefore 1.25.13.00001.25.13.0000Patch availableCNA
WatchGuardWatchGuard Agentbefore 1.17.21.00001.17.21.0000Patch availableCNA
  • WatchGuard Agent VendorWatchGuard Affected before 1.17.01.0000 Fixed in 1.17.01.0000 Patch available CNA
  • WatchGuard Agent VendorWatchGuard Affected before 1.25.13.0000 Fixed in 1.25.13.0000 Patch available CNA
  • WatchGuard Agent VendorWatchGuard Affected before 1.17.21.0000 Fixed in 1.17.21.0000 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:watchguard:agent:*:*:*:*:*:*:*:*——WatchGuard
  • cpe:2.3:a:watchguard:agent:*:*:*:*:*:*:*:* Versions — — ·WatchGuard

Remediation

  • Fix · CNA WatchGuard Agent (WatchGuard) Fixed in 1.17.01.0000
  • Fix · CNA WatchGuard Agent (WatchGuard) Fixed in 1.25.13.0000
  • Fix · CNA WatchGuard Agent (WatchGuard) Fixed in 1.17.21.0000

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WatchGuard Agent 1.25.13.0000

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-41689 WatchGuard Agent path traversal allows unauthenticated remote code executionPriority MEDIUM 43
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57910
  2. 2026-10-03 Alias added: GHSA-6c89-2v98-5qj2

References

Advisory 1

  • TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
  • TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
  • TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5
See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences