Is CVE-2026-6788 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6788 being exploited in the wild.

How severe is CVE-2026-6788?

High severity, with a CVSS score of 7.8, published 6 May 2026.

Which products and versions are affected?

WatchGuard Agent (Windows) versions before 1.25.03.0000.

Is there a fix for CVE-2026-6788?

A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6788 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-6788?

Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6788: WatchGuard Agent uncontrolled search path in Windows

CVE-2026-6788 · Severity: high · CVSS 7.8 · Published 2026-05-06

A vulnerability in the WatchGuard Agent for Windows could allow a local user with limited permissions to gain full administrative control over the system. The WatchGuard Agent is a management tool used to monitor and secure endpoints; an exploit could allow an attacker to bypass security controls, access sensitive data, or disrupt operations. This issue is resolved in version 1.25.03.0000.

Technologies: Watchguard Agent. Vendors: Watchguard.

Quick answers

Is CVE-2026-6788 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6788 being exploited in the wild.
How severe is CVE-2026-6788?: High severity, with a CVSS score of 7.8, published 6 May 2026.
Which products and versions are affected?: WatchGuard Agent (Windows) versions before 1.25.03.0000.
Is there a fix for CVE-2026-6788?: A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6788 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-6788?: Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled search path element (CWE-427) vulnerability exists in the WatchGuard Agent on Windows. This flaw allows a local attacker with low privileges to place a malicious file in a directory searched by the agent service, leading to the execution of arbitrary code with SYSTEM privileges. The vulnerability is often chained with other agent service flaws to achieve full local privilege escalation. The issue is fixed in WatchGuard Agent version 1.25.03.0000.

Affected products

WatchGuard Agent (Windows) versions before 1.25.03.0000

Timeline

2026-05-06: disclosed
2026-05-06: advisory: WatchGuard published advisory WGSA-2026-00013
2026-05-06: patched: Fixed in version 1.25.03.0000

References

https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.