Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code

Two critical unauthenticated remote code execution vulnerabilities in WatchGuard Agent (CVE-2026-57910 and CVE-2026-57909, CVSS 9.3/9.4) allow attackers to trigger TaskExecute or exploit a path traversal to download/execute arbitrary code with elevated (SYSTEM/root) privileges; WatchGuard recommends upgrading to Agent version 1.25.13.0000 or later and monitoring for suspicious UDP discovery, TaskExecute activity, and unexpected binary downloads.