Is CVE-2026-57909 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57909 being exploited in the wild.

How severe is CVE-2026-57909?

Informational severity, with a CVSS score of 9.4, published 25 August 2026.

Which products and versions are affected?

Watchguard Agent Windows < 1.25.13.0000.

Is there a fix for CVE-2026-57909?

A patch was published on 2026-08-26: WatchGuard Agent 1.25.13.0000 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57909 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-57909?

Check whether you run Watchguard Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57909: WatchGuard Agent path traversal remote code execution

Q: Is there a fix for CVE-2026-57909?

A patch was published on 2026-08-26: WatchGuard Agent 1.25.13.0000 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57909 attacked?

It is attacked from the adjacent network, in a hosted service.

Q: Am I affected by CVE-2026-57909?

Check whether you run Watchguard Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57909 · Severity: info · CVSS 9.4 · Published 2026-08-25

WatchGuard Agent is a system utility deployed on Windows endpoints to provide administrative monitoring and management capabilities. A path traversal flaw in the Agent allows an attacker on the same network segment to bypass authentication and execute arbitrary code on affected systems without requiring user interaction or credentials, potentially compromising the entire host and any sensitive data it contains.

Technologies: Watchguard Agent. Vendors: Watchguard.

Quick answers

Is CVE-2026-57909 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57909 being exploited in the wild.
How severe is CVE-2026-57909?: Informational severity, with a CVSS score of 9.4, published 25 August 2026.
Which products and versions are affected?: Watchguard Agent Windows < 1.25.13.0000.
Is there a fix for CVE-2026-57909?: A patch was published on 2026-08-26: WatchGuard Agent 1.25.13.0000 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57909 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-57909?: Check whether you run Watchguard Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal leading to code injection (CWE-94) combined with missing authentication for a critical function (CWE-306). An unauthenticated attacker on an adjacent network (same network segment) can exploit the path traversal to manipulate code generation or execution paths, resulting in arbitrary remote code execution. No user interaction or prior authentication is required; the vulnerability is network-reachable via the local network. WatchGuard released a patch in version 1.25.13.0000, and there are currently no reports of active exploitation in the wild.

Affected products

WatchGuard Agent Windows < 1.25.13.0000

Timeline

2026-08-25: disclosed
2026-08-26: patched: WatchGuard Agent 1.25.13.0000 released

References

https://psirt.watchguard.com/CVE-2026-57909

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.