Quick answers
- Is CVE-2026-41287 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41287 being exploited in the wild.
- How severe is CVE-2026-41287?
- Medium severity, with a CVSS score of 6.5, published 6 May 2026.
- Which products and versions are affected?
- WatchGuard WatchGuard Agent up to and including 1.25.02.0000.
- Is there a fix for CVE-2026-41287?
- A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41287 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-41287?
- Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow (CWE-121) exists within the discovery service component of the WatchGuard Agent for Windows. The vulnerability is triggered when the service processes specially crafted network traffic, leading to a memory corruption event. An unauthenticated attacker located on the same adjacent network (Layer 2) can exploit this to cause a denial-of-service (DoS) by crashing the agent service. The issue affects versions up to and including 1.25.02.0000 and is resolved in version 1.25.03.0000.
Affected products
- WatchGuard WatchGuard Agent up to and including 1.25.02.0000
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched: Fixed in version 1.25.03.0000