# CVE-2026-41286: WatchGuard Agent stack overflow in discovery service

Source: https://junglewise.ai/threats/cve-2026-41286-watchguard-agent-stack-overflow-in-discovery-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41286 · Severity: medium · CVSS 6.5 · Published 2026-05-06

The WatchGuard Agent, a software component used for managing and monitoring Windows devices, contains a security flaw in its discovery service. An attacker on the same local network can exploit this to crash the agent service, leading to a denial-of-service condition. This prevents the agent from performing its management tasks and may disrupt security operations on the affected machine.

Technologies: [Watchguard Agent](https://junglewise.ai/threats/technologies/agent). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2026-41286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41286 being exploited in the wild.

**How severe is CVE-2026-41286?** Medium severity, with a CVSS score of 6.5, published 6 May 2026.

**Which products and versions are affected?** WatchGuard Agent (Windows) up to and including 1.25.02.0000.

**Is there a fix for CVE-2026-41286?** A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41286 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-41286?** Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the WatchGuard Agent discovery service on Windows. The vulnerability is triggered when the service processes specially crafted discovery packets, leading to a memory corruption that crashes the process. An unauthenticated attacker located on the same adjacent network (Layer 2) can exploit this without user interaction. The primary impact is a denial-of-service (DoS) of the agent service. The issue is resolved in WatchGuard Agent version 1.25.03.0000.

## Affected products

- WatchGuard Agent (Windows) up to and including 1.25.02.0000

## Timeline

- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched: Fixed in version 1.25.03.0000

## References

- [https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00011](https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00011)

## Related threats

- [WatchGuard Agent improper authentication in RCE](https://junglewise.ai/threats/cve-2026-57910-watchguard-agent-improper-authentication-in-rce)
- [WatchGuard Agent path traversal remote code execution](https://junglewise.ai/threats/cve-2026-57909-watchguard-agent-path-traversal-remote-code-execution)
- [WatchGuard Agent uncontrolled search path in Windows](https://junglewise.ai/threats/cve-2026-6788-watchguard-agent-uncontrolled-search-path-in-windows)
- [WatchGuard Agent hard-coded cryptographic key in Windows agent](https://junglewise.ai/threats/cve-2026-6787-watchguard-agent-hard-coded-cryptographic-key-in-windows-agent)
- [WatchGuard Agent privilege escalation in patch management component](https://junglewise.ai/threats/cve-2026-41288-watchguard-agent-privilege-escalation-in-patch-management)