Is CVE-2026-41286 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41286 being exploited in the wild.

How severe is CVE-2026-41286?

Medium severity, with a CVSS score of 6.5, published 6 May 2026.

Which products and versions are affected?

WatchGuard Agent (Windows) up to and including 1.25.02.0000.

Is there a fix for CVE-2026-41286?

A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41286 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-41286?

Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41286: WatchGuard Agent stack overflow in discovery service

CVE-2026-41286 · Severity: medium · CVSS 6.5 · Published 2026-05-06

The WatchGuard Agent, a software component used for managing and monitoring Windows devices, contains a security flaw in its discovery service. An attacker on the same local network can exploit this to crash the agent service, leading to a denial-of-service condition. This prevents the agent from performing its management tasks and may disrupt security operations on the affected machine.

Technologies: Watchguard Agent. Vendors: Watchguard.

Quick answers

Is CVE-2026-41286 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41286 being exploited in the wild.
How severe is CVE-2026-41286?: Medium severity, with a CVSS score of 6.5, published 6 May 2026.
Which products and versions are affected?: WatchGuard Agent (Windows) up to and including 1.25.02.0000.
Is there a fix for CVE-2026-41286?: A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41286 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-41286?: Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the WatchGuard Agent discovery service on Windows. The vulnerability is triggered when the service processes specially crafted discovery packets, leading to a memory corruption that crashes the process. An unauthenticated attacker located on the same adjacent network (Layer 2) can exploit this without user interaction. The primary impact is a denial-of-service (DoS) of the agent service. The issue is resolved in WatchGuard Agent version 1.25.03.0000.

Affected products

WatchGuard Agent (Windows) up to and including 1.25.02.0000

Timeline

2026-05-06: disclosed
2026-05-06: advisory
2026-05-06: patched: Fixed in version 1.25.03.0000

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00011

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.