Critical severity · published Aug 25, 2026
CVE-2026-57910
WatchGuard Agent improper authentication allows unauthenticated remote code execution
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WatchGuard Agent · WatchGuard
before 1.17.01.0000; before 1.25.13.0000; before 1.17.21.0000 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57910
psirt.watchguard.com
https://psirt.watchguard.com/CVE-2026-57910
More from WatchGuard Agent
9.4
CVE-2026-57909
WatchGuard Agent path traversal allows unauthenticated remote code execution
7.8
CVE-2026-6788
Uncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent
7.8
CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing process
7.8
CVE-2026-41288
WatchGuard Agent on Windows Privilege Escalation Vulnerability
7.3
CVE-2026-115253
WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering