CVE-2026-41288Disclosure(watchguard / agent)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch watchguard agent systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.

watchguard CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-732

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

agent

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-05-06); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

watchguard

Products

agent

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

360.0%

General

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-06	2	Disclosure1General1
2026-05-07	1	General1
2026-05-14	1	Disclosure1
2026-05-20	1	Disclosure1

Full discourse5 posts

Autumn Good@autumn_good_35154d
General
権限昇格2件とDoS2件 CVE-2026-6787, CVE-2026-6788 CVE-2026-41288 CVE-2026-41286 CVE-2026-41287 Security Advisories | WatchGuard Technologies https://www.watchguard.com/wgrd-psirt/advisories
Post summary
The entry lists several CVEs with brief vulnerability types and points to WatchGuard’s security advisories, but does not provide PoC, exploit code, active exploitation evidence, or explicit patch information.
00020330
6.9K followersView on X
iototsecnews@iototsecnews147d
Disclosure
WatchGuard Agent for Windows の複数の脆弱性が FIX：SYSTEM 権限取得の恐れ https://iototsecnews.jp/2026/05/07/watchguard-agent-flaws-allow-attackers-to-gain-full-system-privileges-on-windows/ 今回の脆弱性の原因は、プログラム内部での権限管理やメモリ処理の不備にあります。 CVE-2026-6787／CVE-2026-6788 では複数の小さな不具合が連鎖したことが原因で、また、CVE-2026-41288 ではリソースへの権限割り当てミスが原因で、本来制限されるべき一般ユーザーが管理者権限を得られる状態になっていました。また、 CVE-2026-41286／CVE-2026-41287 では、外部からのデータを受け取る際のメモリ領域の確認が不十分だったことで、サービス停止を招くバッファ・オーバーフローが発生しています。ご利用のチームは、ご注意ください。 #AgentforWindows #CVE20266787 #CVE20266788 #Vulnerability #WatchGuard
Post summary
The advisory announces the discovery and fix of several WatchGuard Agent for Windows vulnerabilities, detailing privilege escalation and buffer‑overrun weaknesses and indicating that a patch is available.
01000110
491 followersView on X
CVE@CVEnew155d
Disclosure
CVE-2026-41288 Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate thei… https://www.cve.org/CVERecord?id=CVE-2026-41288
Post summary
The tweet announces CVE-2026-41288, describing a privilege‑escalation flaw in WatchGuard Agent. It provides only basic vulnerability details without any PoC, exploit, patch, or exploitation claims.
00010143
57.4K followersView on X
CERT-PY@CERTpy141d
Disclosure
⚠️ Vulnerabilidades en productos WatchGuard ❗ CVE-2026-6788 ❗ CVE-2026-6787 ❗ CVE-2026-41288 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-watchguard-4/ https://t.co/8UkUk2fooU
Post summary
The post lists three WatchGuard CVEs and offers a link to a source for additional details, without providing technical or exploit information.
00000117
6.7K followersView on X
Infoflowcloud@infoflowcloud155d
General
🚨*CVE* CVE-2026-41288 Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate thei… https://www.cve.org/CVERecord?id=CVE-2026-41288 ----- Traducción: CVE-2026-41288 Asi… http://infoflow.cloud`
Post summary
The tweet lists CVE‑2026‑41288, noting an authenticated local privilege‑escalation flaw in the WatchGuard Agent’s patch management component, but provides no further exploit details, patches, or claims of active exploitation.
0000035
75 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	watchguard	agent	-	windows	-

Explore more

Back to dashboard watchguard CVEs agent vulnerabilities

What researchers are saying

CVE-2026-41288

Autumn Good@autumn_good_35General

The entry lists several CVEs with brief vulnerability types and points to WatchGuard’s security advisories, but does not provide PoC, exploit code, active exploitation evidence, or explicit patch information.

iototsecnews@iototsecnewsDisclosure

The advisory announces the discovery and fix of several WatchGuard Agent for Windows vulnerabilities, detailing privilege escalation and buffer‑overrun weaknesses and indicating that a patch is available.

CVE@CVEnewDisclosure

The tweet announces CVE-2026-41288, describing a privilege‑escalation flaw in WatchGuard Agent. It provides only basic vulnerability details without any PoC, exploit, patch, or exploitation claims.

CERT-PY@CERTpyDisclosure

The post lists three WatchGuard CVEs and offers a link to a source for additional details, without providing technical or exploit information.

Infoflowcloud@infoflowcloudGeneral

The tweet lists CVE‑2026‑41288, noting an authenticated local privilege‑escalation flaw in the WatchGuard Agent’s patch management component, but provides no further exploit details, patches, or claims of active exploitation.