Is CVE-2026-57907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57907 being exploited in the wild.

How severe is CVE-2026-57907?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Watchguard Endpoint Security Windows 0 to 8.00.26.0010.

Is there a fix for CVE-2026-57907?

Yes: fixed in Endpoint Security Windows 8.00.26.0011 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57907 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-57907?

Check whether you run Watchguard Endpoint Security Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57907: WatchGuard Endpoint Protection privilege escalation in inter-process communication

CVE-2026-57907 · Severity: info · Published 2026-11-10

WatchGuard Endpoint Protection is security software that protects Windows systems from malware and threats. A vulnerability in how its console and protection service communicate allows a low-privileged user already on the system to execute arbitrary code with SYSTEM-level privileges, giving an attacker complete control of the protected computer.

Vendors: Watchguard.

Quick answers

Is CVE-2026-57907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57907 being exploited in the wild.
How severe is CVE-2026-57907?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Watchguard Endpoint Security Windows 0 to 8.00.26.0010.
Is there a fix for CVE-2026-57907?: Yes: fixed in Endpoint Security Windows 8.00.26.0011 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57907 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-57907?: Check whether you run Watchguard Endpoint Security Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Endpoint Security Windows 8.00.26.0011 or later

Technical details

A privilege escalation vulnerability exists in WatchGuard Endpoint Protection's inter-process communication between the console and protection service (CWE-269: Improper Privilege Management). A local, low-privileged authenticated user can inject code into the trusted console process and issue privileged commands to the service to execute arbitrary code with SYSTEM privileges. The vulnerability requires local access and authentication but no network connectivity.

Affected products

WatchGuard Endpoint Security Windows 0 to 8.00.26.0010

Timeline

2026-11-10: disclosed

References

https://psirt.watchguard.com/CVE-2026-57907

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.