Improper authentication in the WatchGuard Agent

CVE-2026-57910 is a missing-authentication flaw (CWE-306) in the WatchGuard Agent, the lightweight endpoint management service that WatchGuard Cloud uses to deploy software, push updates, and monitor every managed host. The agent listens on TCP port 33000 and UDP port 21226 for inter-agent and cloud communications. Because the authentication step on this channel is simply absent, any unauthenticated attacker with network adjacency can send crafted requests to the agent and achieve arbitrary code execution with the agent's elevated privileges — typically NT AUTHORITY\SYSTEM on Windows. All versions prior to 1.25.13.0000 are affected; the fix shipped August 19, 2026.

WatchGuard's own PSIRT page tags this at CVSS 9.3, which is honest and appropriate. A management agent that runs on every endpoint with SYSTEM-level privileges and accepts unauthenticated commands over the network is textbook CWE-306 critical-impact. The only friction preventing a 10.0 is that the attack surface is network-adjacent rather than internet-reachable — attackers need a foothold on the LAN or a bridged VPN segment first. But that single prerequisite does not meaningfully soften the blast radius: once inside, an attacker can fan out to every WatchGuard-managed host in minutes.

Why this verdict

• Unauthenticated RCE as SYSTEM: CWE-306 means zero credentials, tokens, or certificates are required. Any network-adjacent attacker sends commands and gets code execution at the highest Windows privilege level.
• Role multiplier — fleet management agent: The WatchGuard Agent is deployed on *every* managed endpoint by architectural design. Compromising the agent's communication channel on one subnet yields RCE on every reachable managed host. On domain controllers this is immediate DA; on hypervisors it's guest escape; on backup servers it's ransomware-ready. The blast radius is fleet-scale, not host-scale.
• Minimal friction to mass exploitation: The only real prerequisite is internal network access — a single phished workstation or VPN credential. From there, UDP 21226 discovery scanning finds every agent, and the missing authentication makes automated exploitation trivial once the protocol is reversed.
• No compensating default controls: The agent does not ship with host-firewall rules restricting inbound connections to management-only subnets. In flat networks (still the majority of SMB deployments using WatchGuard), every agent is reachable from every other host.

Why not higher?

A 10.0 would require unauthenticated *remote* exploitation over the internet without any prior access. This vulnerability requires network adjacency — the attacker must already be on the LAN or a bridged segment. That prerequisite, while low-friction for a motivated attacker, is a genuine narrowing from internet-reachable to post-initial-access. The lack of a public PoC also slightly slows time-to-weaponization.

Why not lower?

Downgrading below CRITICAL is not defensible. The affected component is a canonical fleet-management agent — 100% of WatchGuard-managed endpoints run it by definition. The blast radius of successful exploitation is not 'one host' but 'every managed host on reachable subnets,' which in most deployments means the entire fleet. The SYSTEM-level execution privilege means credential harvesting, EDR disablement, and domain escalation are immediate post-exploitation steps. Network-adjacency is not a meaningful friction point when the attacker's initial access host *itself* runs the vulnerable agent.

1. Segment agent traffic to a dedicated management VLAN — Restrict TCP 33000 and UDP 21226 to a management subnet that only WatchGuard Cloud management servers and designated admin workstations can reach. This eliminates the network-adjacency prerequisite from compromised user workstations. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL findings.
2. Deploy host-firewall rules blocking inbound 33000/21226 from non-management sources — On every managed endpoint, add Windows Firewall or iptables rules that DROP inbound connections to these ports from any source outside the WatchGuard management IP range. Push via GPO or your endpoint management platform. Deploy within 3 days.
3. Monitor for anomalous agent parent-child process chains — Create EDR detection rules alerting on the WatchGuard Agent service spawning unexpected child processes (cmd.exe, powershell.exe, whoami.exe, net.exe, rundll32.exe). This catches post-exploitation even if the initial auth bypass succeeds. Deploy within 3 days.
4. Accelerate patch deployment to 1.25.13.0000 — Use WatchGuard Cloud's auto-update feature or SCCM/Intune to push the fixed agent version immediately. Prioritize domain controllers, hypervisors, backup servers, and other Tier 0/1 assets. Target full fleet coverage within the noisgate remediation SLA of 90 days, but aim for high-value hosts within 7 days.

Run this script on each Windows endpoint where the WatchGuard Agent may be installed. No special privileges required — it reads the agent file version from the filesystem. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-57910.ps1

# Check-CVE-2026-57910.ps1
# Checks WatchGuard Agent version against CVE-2026-57910 fix (1.25.13.0000)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$agentPaths = @(
    "$env:ProgramFiles\WatchGuard\WatchGuard Agent\WatchGuardAgent.exe",
    "${env:ProgramFiles(x86)}\WatchGuard\WatchGuard Agent\WatchGuardAgent.exe"
)

$found = $false
foreach ($path in $agentPaths) {
    if (Test-Path $path) {
        $found = $true
        try {
            $ver = (Get-Item $path).VersionInfo.FileVersion
            $parsed = [System.Version]$ver
            $fixed  = [System.Version]"1.25.13.0"
            if ($parsed -ge $fixed) {
                Write-Host "PATCHED - WatchGuard Agent version $ver is >= 1.25.13.0000"
                exit 0
            } else {
                Write-Host "VULNERABLE - WatchGuard Agent version $ver is below 1.25.13.0000 (CVE-2026-57910)"
                exit 1
            }
        } catch {
            Write-Host "UNKNOWN - Found agent at $path but could not parse version: $_"
            exit 2
        }
    }
}

if (-not $found) {
    Write-Host "UNKNOWN - WatchGuard Agent not found at expected paths. Agent may not be installed or is in a custom location."
    exit 2
}

Sources

1. WatchGuard PSIRT Advisory (CVE-2026-57910)
2. WatchGuard Agent Release Notes (v1.25.13.000)
3. Canadian Centre for Cyber Security — WatchGuard Advisory AV26-428
4. WatchGuard Agent Product Page
5. WatchGuard Cloud Network Access Requirements (Ports)
6. CWE-306: Missing Authentication for Critical Function
7. WatchGuard Security Advisories Index