# CVE-2026-57910: WatchGuard Agent improper authentication in RCE

Source: https://junglewise.ai/threats/cve-2026-57910-watchguard-agent-improper-authentication-in-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57910 · Severity: info · CVSS 9.3 · Published 2026-08-25

WatchGuard Agent is a client application that protects endpoints by enforcing security policies and monitoring activity. A flaw in the agent's authentication mechanism allows remote attackers on the network to bypass security checks and execute arbitrary code with elevated system privileges, potentially leading to complete device compromise and lateral movement into corporate networks.

Technologies: [Watchguard Agent](https://junglewise.ai/threats/technologies/agent). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2026-57910 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57910 being exploited in the wild.

**How severe is CVE-2026-57910?** Informational severity, with a CVSS score of 9.3, published 25 August 2026.

**Which products and versions are affected?** Watchguard Agent Windows < 1.25.13.0000, macOS < 1.17.21.0000, Linux < 1.17.01.0000.

**Is there a fix for CVE-2026-57910?** A patch was published on 2026-08-25: Patched versions available: Windows 1.25.13.0000+, macOS 1.17.21.0000+, Linux 1.17.01.0000+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57910 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57910?** Check whether you run Watchguard Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper authentication and weak cryptographic signature verification in the WatchGuard Agent, tracked under CWE-306 (Missing Authentication), CWE-347 (Improper Verification of Cryptographic Signature), and CWE-494 (Download of Code Without Integrity Check). An unauthenticated attacker with network access to the agent can exploit this to trigger arbitrary code execution with elevated privileges. The attack requires no user interaction or prior authentication. Patches are available: Windows version 1.25.13.0000 and later, macOS version 1.17.21.0000 and later, and Linux version 1.17.01.0000 and later.

## Affected products

- WatchGuard Agent Windows < 1.25.13.0000, macOS < 1.17.21.0000, Linux < 1.17.01.0000

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: patched: Patched versions available: Windows 1.25.13.0000+, macOS 1.17.21.0000+, Linux 1.17.01.0000+

## References

- [https://psirt.watchguard.com/CVE-2026-57910](https://psirt.watchguard.com/CVE-2026-57910)

## Related threats

- [WatchGuard Agent path traversal remote code execution](https://junglewise.ai/threats/cve-2026-57909-watchguard-agent-path-traversal-remote-code-execution)
- [WatchGuard Agent uncontrolled search path in Windows](https://junglewise.ai/threats/cve-2026-6788-watchguard-agent-uncontrolled-search-path-in-windows)
- [WatchGuard Agent hard-coded cryptographic key in Windows agent](https://junglewise.ai/threats/cve-2026-6787-watchguard-agent-hard-coded-cryptographic-key-in-windows-agent)
- [WatchGuard Agent privilege escalation in patch management component](https://junglewise.ai/threats/cve-2026-41288-watchguard-agent-privilege-escalation-in-patch-management)
- [WatchGuard Agent stack overflow in discovery service](https://junglewise.ai/threats/cve-2026-41286-watchguard-agent-stack-overflow-in-discovery-service)