- The Mess: WatchGuard disclosed CVE-2026-57910 and CVE-2026-57909, two Critical vulnerabilities in its Windows WatchGuard Agent. Both can lead to arbitrary code execution without authentication; they carry CVSS 9.3 and 9.4 respectively.
The first one is particularly ugly.
CVE-2026-57910 is an authentication failure in the Agent’s UDP discovery and command service. An attacker with network access can trigger the TaskExecute handler and make the agent download and execute attacker-controlled software with elevated privileges.
No password.
No user interaction.
No legitimate account.
The second bug, CVE-2026-57909, uses path traversal to reach arbitrary code execution. It requires the attacker to be on an adjacent network, which narrows the attack surface but doesn’t make it harmless. A compromised Wi-Fi segment, VPN environment or another infected machine on the same network can potentially become the starting point.
And there’s an especially bad combination here.
The vulnerable software is itself a security agent.
Its job is to help protect and manage endpoints.
Instead, an attacker can potentially use it as a privileged execution mechanism.
- The Damage: Successful exploitation can give an unauthenticated attacker elevated code execution on the Windows endpoint, allowing malware installation, persistence, data theft, security-control tampering and lateral movement.
The first vulnerability is network-accessible.
That matters.
An attacker doesn’t necessarily need physical access to the machine. If the relevant Agent service can be reached from the attacker’s network position, the missing authentication becomes the problem.
And because the Agent operates with elevated privileges, the attacker isn’t merely executing code as an ordinary Windows user.
They’re potentially getting the keys to the machine.
The second vulnerability is more constrained.
But enterprise networks are messy.
A compromised workstation can provide adjacent-network access.
So can a rogue device.
So can a compromised VPN segment.
Once an attacker gets one foothold, bugs like this can turn lateral movement into privilege escalation.
WatchGuard says it was not aware of exploitation in the wild as of August 25. That’s good news. But both vulnerabilities are already publicly documented, and CISA’s enrichment marks their technical impact as total.
Waiting for attackers to demonstrate the exploit publicly is a terrible patching strategy.
- The Fix: Update WatchGuard Agent to 1.25.13.0000 or later immediately; supported older branches also have fixes for CVE-2026-57910, and organizations should prioritize systems reachable from untrusted or shared networks.
Then investigate.
Check which Agent versions are deployed.
Look for unexpected downloads initiated by the WatchGuard Agent service.
Review unusual UDP discovery traffic.
Look for unexpected processes spawned by the Agent.
And pay particular attention to endpoints that were reachable from guest Wi-Fi, VPN networks or other less-trusted segments.
Don’t assume your EDR will magically make this harmless.
If a security agent itself is abused to execute code with elevated privileges, your defensive stack becomes part of the incident response problem.
Bugstoday Opinion
There’s something deeply ironic about this one.
You install security software to reduce your attack surface.
Then the security software gets two 9.x-rated unauthenticated RCE vulnerabilities.
That’s not a theoretical inconvenience.
It’s a privileged execution path sitting inside enterprise endpoints.
The good news: no exploitation in the wild has been reported by WatchGuard.
The bad news: the CVEs are public, the technical details are available, and the required attack conditions for the first flaw aren’t exactly exotic.
Bugstoday verdict: patch the Agent before someone turns your security software into a malware launcher. Security products don’t get a free pass just because their logo has a shield on it.
