WatchGuard WatchGuard Agent / EPDR Vulnerabilities & Security Advisories
8 advisories tracked · WatchGuard PSIRT Advisories via NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published WatchGuard advisory that VulniPulse classified as WatchGuard Agent / EPDR, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 3 critical, 5 high.
Android app · Google Play
Monitor WatchGuard CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
WatchGuard PSIRT Advisories via NVD
WatchGuard is not its own NVD CNA and its PSIRT portal has no machine-readable feed, so VulniPulse ingests WatchGuard's CVEs from NVD (keyword-filtered to WatchGuard, requiring a WatchGuard product in the description) and links each CVE back to the wgrd-psirt advisory when referenced. Covers Fireware OS on the Firebox firewall line, WatchGuard System Manager, the WatchGuard Agent / EPDR endpoint and AuthPoint MFA — SMB firewalls previously mass-exploited by the Cyclops Blink botnet, so a patch-now audience.
Latest WatchGuard WatchGuard Agent / EPDR advisories
Critical [CVE-2026-13043] missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.
Critical [CVE-2026-57910] Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
Critical [CVE-2026-57909] path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system
A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.
High [CVE-2026-6788] Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files
Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.
High [CVE-2026-6787] Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process
Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process.
High [CVE-2026-41288] Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM
Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.
High [CVE-2026-41286] Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers
Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated attacker on the same local network could exploit this vulnerability to crash the agent service.
High [CVE-2024-8424] WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM
Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with SYSTEM permissions. Affected products named by the advisory: Endpoint Security.