# CVE-2026-6787: WatchGuard Agent hard-coded cryptographic key in Windows agent

Source: https://junglewise.ai/threats/cve-2026-6787-watchguard-agent-hard-coded-cryptographic-key-in-windows-agent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6787 · Severity: high · CVSS 7.8 · Published 2026-05-06

A security vulnerability in the WatchGuard Agent for Windows could allow a local user to gain full administrative control over a computer. The software, which is used to manage and secure endpoints, contains a flaw that allows an attacker to inject and run unauthorized code. This could lead to a complete system takeover, allowing the attacker to access sensitive data or disable security protections.

Technologies: [Watchguard Agent](https://junglewise.ai/threats/technologies/agent). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2026-6787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6787 being exploited in the wild.

**How severe is CVE-2026-6787?** High severity, with a CVSS score of 7.8, published 6 May 2026.

**Which products and versions are affected?** Watchguard Agent (Windows) before 1.25.03.0000.

**Is there a fix for CVE-2026-6787?** A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6787 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-6787?** Check whether you run Watchguard Agent or Watchguard Agent (Windows) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WatchGuard Agent for Windows (versions prior to 1.25.03.0000) contains a hard-coded cryptographic key (CWE-321). This vulnerability allows a local attacker with low privileges to bypass security controls and inject code into existing agent processes. When chained with other service vulnerabilities, this can lead to local privilege escalation (LPE) to SYSTEM. The issue is resolved in version 1.25.03.0000. Attackers must have local access to the target machine to exploit this flaw.

## Affected products

- WatchGuard WatchGuard Agent (Windows) before 1.25.03.0000

## Timeline

- 2026-05-06: disclosed: Initial disclosure by WatchGuard
- 2026-05-06: patched: Fixed in version 1.25.03.0000
- 2026-05-06: advisory: WatchGuard advisory WGSA-2026-00013 published

## References

- [https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013](https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013)

## Related threats

- [WatchGuard Agent incorrect permission assignment in log directory](https://junglewise.ai/threats/cve-2026-115253-an-incorrect-permission-assignment-vulnerability-in-the)
- [WatchGuard Agent improper authentication in RCE](https://junglewise.ai/threats/cve-2026-57910-watchguard-agent-improper-authentication-in-rce)
- [WatchGuard Agent path traversal remote code execution](https://junglewise.ai/threats/cve-2026-57909-watchguard-agent-path-traversal-remote-code-execution)
- [WatchGuard Agent uncontrolled search path in Windows](https://junglewise.ai/threats/cve-2026-6788-watchguard-agent-uncontrolled-search-path-in-windows)
- [WatchGuard Agent privilege escalation in patch management component](https://junglewise.ai/threats/cve-2026-41288-watchguard-agent-privilege-escalation-in-patch-management)