Critical Vulnerabilities in WatchGuard Agent Enable Remote Code Execution

Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-57909 and CVE-2026-57910) were disclosed in WatchGuard Agent versions before 1.25.13.0000. The flaws—rooted in improper authentication and path traversal—have CVSS scores of 9.3 and 9.4, grant elevated privileges to attackers, are widely deployed across platforms, and have confirmed exploitation in the wild; WatchGuard advises immediate patching to mitigate risks including ransomware and data theft.