Is CVE-2026-6787 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6787 being exploited in the wild.

How severe is CVE-2026-6787?

High severity, with a CVSS score of 7.8, published 6 May 2026.

Which products and versions are affected?

Watchguard Agent (Windows) before 1.25.03.0000.

Is there a fix for CVE-2026-6787?

A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6787 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-6787?

Check whether you run Watchguard Agent or Watchguard Agent (Windows) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6787: WatchGuard Agent hard-coded cryptographic key in Windows agent

CVE-2026-6787 · Severity: high · CVSS 7.8 · Published 2026-05-06

A security vulnerability in the WatchGuard Agent for Windows could allow a local user to gain full administrative control over a computer. The software, which is used to manage and secure endpoints, contains a flaw that allows an attacker to inject and run unauthorized code. This could lead to a complete system takeover, allowing the attacker to access sensitive data or disable security protections.

Technologies: Watchguard Agent. Vendors: Watchguard.

Quick answers

Is CVE-2026-6787 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6787 being exploited in the wild.
How severe is CVE-2026-6787?: High severity, with a CVSS score of 7.8, published 6 May 2026.
Which products and versions are affected?: Watchguard Agent (Windows) before 1.25.03.0000.
Is there a fix for CVE-2026-6787?: A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6787 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-6787?: Check whether you run Watchguard Agent or Watchguard Agent (Windows) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WatchGuard Agent for Windows (versions prior to 1.25.03.0000) contains a hard-coded cryptographic key (CWE-321). This vulnerability allows a local attacker with low privileges to bypass security controls and inject code into existing agent processes. When chained with other service vulnerabilities, this can lead to local privilege escalation (LPE) to SYSTEM. The issue is resolved in version 1.25.03.0000. Attackers must have local access to the target machine to exploit this flaw.

Affected products

WatchGuard WatchGuard Agent (Windows) before 1.25.03.0000

Timeline

2026-05-06: disclosed: Initial disclosure by WatchGuard
2026-05-06: patched: Fixed in version 1.25.03.0000
2026-05-06: advisory: WatchGuard advisory WGSA-2026-00013 published

References

https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.