# CVE-2026-6788: WatchGuard Agent uncontrolled search path in Windows

Source: https://junglewise.ai/threats/cve-2026-6788-watchguard-agent-uncontrolled-search-path-in-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6788 · Severity: high · CVSS 7.8 · Published 2026-05-06

A vulnerability in the WatchGuard Agent for Windows could allow a local user with limited permissions to gain full administrative control over the system. The WatchGuard Agent is a management tool used to monitor and secure endpoints; an exploit could allow an attacker to bypass security controls, access sensitive data, or disrupt operations. This issue is resolved in version 1.25.03.0000.

Technologies: [Watchguard Agent](https://junglewise.ai/threats/technologies/agent). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2026-6788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6788 being exploited in the wild.

**How severe is CVE-2026-6788?** High severity, with a CVSS score of 7.8, published 6 May 2026.

**Which products and versions are affected?** WatchGuard Agent (Windows) versions before 1.25.03.0000.

**Is there a fix for CVE-2026-6788?** A patch was published on 2026-05-06: Fixed in version 1.25.03.0000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6788 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-6788?** Check whether you run Watchguard Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled search path element (CWE-427) vulnerability exists in the WatchGuard Agent on Windows. This flaw allows a local attacker with low privileges to place a malicious file in a directory searched by the agent service, leading to the execution of arbitrary code with SYSTEM privileges. The vulnerability is often chained with other agent service flaws to achieve full local privilege escalation. The issue is fixed in WatchGuard Agent version 1.25.03.0000.

## Affected products

- WatchGuard Agent (Windows) versions before 1.25.03.0000

## Timeline

- 2026-05-06: disclosed
- 2026-05-06: advisory: WatchGuard published advisory WGSA-2026-00013
- 2026-05-06: patched: Fixed in version 1.25.03.0000

## References

- [https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013](https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013)

## Related threats

- [WatchGuard Agent improper authentication in RCE](https://junglewise.ai/threats/cve-2026-57910-watchguard-agent-improper-authentication-in-rce)
- [WatchGuard Agent path traversal remote code execution](https://junglewise.ai/threats/cve-2026-57909-watchguard-agent-path-traversal-remote-code-execution)
- [WatchGuard Agent hard-coded cryptographic key in Windows agent](https://junglewise.ai/threats/cve-2026-6787-watchguard-agent-hard-coded-cryptographic-key-in-windows-agent)
- [WatchGuard Agent privilege escalation in patch management component](https://junglewise.ai/threats/cve-2026-41288-watchguard-agent-privilege-escalation-in-patch-management)
- [WatchGuard Agent stack overflow in discovery service](https://junglewise.ai/threats/cve-2026-41286-watchguard-agent-stack-overflow-in-discovery-service)