CVE-2026-57909: CWE-306 in WatchGuard WatchGuard Agent

This vulnerability in WatchGuard Agent involves a path traversal flaw that enables remote, unauthenticated attackers on an adjacent network to execute arbitrary code on the vulnerable system. The CVSS 4.0 vector indicates the attack requires adjacent network access, no privileges, no user interaction, and results in high confidentiality, integrity, availability, system confidentiality, system integrity, and system availability impacts. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-94 (Improper Control of Generation of Code). No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers without authentication to execute arbitrary code on the affected system, potentially leading to full system compromise. The attack requires adjacency on the network but no privileges or user interaction, making it highly severe. The vulnerability impacts confidentiality, integrity, and availability at both the system and component levels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the WatchGuard Agent from untrusted adjacent networks and monitor for suspicious activity related to path traversal attempts.