WatchGuard Agent for Windows hard-coded cryptographic key local code inclusion flaw

# check-watchguard-agent-cve-2026-6787.ps1

# Purpose: Detect whether WatchGuard Agent for Windows is vulnerable to CVE-2026-6787 based on installed version.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'1.25.3.0'

function Get-WGAgentVersion {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $hits = foreach ($path in $paths) {
        Get-ItemProperty $path | Where-Object {
            $_.DisplayName -match 'WatchGuard Agent'
        } | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation
    }

    if ($hits) {
        $best = $hits | Where-Object { $_.DisplayVersion } | Select-Object -First 1
        if ($best -and $best.DisplayVersion) {
            return $best.DisplayVersion
        }
    }

    # Fallback: inspect common service binary paths if uninstall entry was not found

    $candidatePaths = @(
        'C:\Program Files\WatchGuard\*\*.exe',
        'C:\Program Files (x86)\WatchGuard\*\*.exe'
    )

    foreach ($pattern in $candidatePaths) {
        $file = Get-ChildItem -Path $pattern -Recurse -File | Select-Object -First 1
        if ($file) {
            return $file.VersionInfo.ProductVersion
        }
    }

    return $null
}

$rawVersion = Get-WGAgentVersion

if (-not $rawVersion) {
    Write-Output 'UNKNOWN: WatchGuard Agent not found or version could not be determined.'
    exit 2
}

# Normalize 4-part version like 1.25.03.0000 -> 1.25.3.0

try {
    $normalized = ($rawVersion -replace '^v','').Trim()
    $parts = $normalized.Split('.')
    while ($parts.Count -lt 4) { $parts += '0' }
    $parts = $parts[0..3] | ForEach-Object { [int]$_ }
    $installedVersion = [version]::new($parts[0], $parts[1], $parts[2], $parts[3])
}
catch {
    Write-Output "UNKNOWN: Found WatchGuard Agent version '$rawVersion' but failed to parse it."
    exit 2
}

if ($installedVersion -lt $fixedVersion) {
    Write-Output "VULNERABLE: WatchGuard Agent version $installedVersion is older than fixed version $fixedVersion."
    exit 1
}
else {
    Write-Output "PATCHED: WatchGuard Agent version $installedVersion is at or above fixed version $fixedVersion."
    exit 0
}