CVE-2026-41288: WatchGuard Agent on Windows Privilege Escalation Vulnerability
Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Agent (Windows)to a version that resolves this vulnerability.Fixed in 1.25.03.0000 - Compensating control
Limit local access to the WatchGuard Agent resources and management surfaces to trusted users until the patch is applied (e.g., restrict interactive logon/execute permissions for the agent-related directories/services to administrators only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41288?
CVE-2026-41288 is considered a critical vulnerability due to its potential for privileged escalation.
How do I fix CVE-2026-41288?
To fix CVE-2026-41288, update to the latest version of the WatchGuard Agent for Windows provided by WatchGuard.
Who is affected by CVE-2026-41288?
CVE-2026-41288 affects authenticated local users of WatchGuard Agent on Windows systems.
What type of vulnerability is CVE-2026-41288?
CVE-2026-41288 is a privilege escalation vulnerability related to incorrect permission assignments.
Can CVE-2026-41288 be exploited remotely?
No, CVE-2026-41288 requires local authentication to exploit, restricting it to local users only.