WATCHGUARD ENDPOINT PROTECTION · CVE-2026-57907 · Vendor
FIX → 8.00.26.0011 ✓ verified
A flaw in how WatchGuard Endpoint Protection's console and protection service talk to each other lets a low-privileged local user inject code into the trusted console process. From there the user can send privileged commands to the service and run arbitrary code with SYSTEM rights.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Windows machine running WatchGuard Endpoint Protection where ordinary users can log in locally is exposed, since the attacker only needs a low-privileged local account. Servers and endpoints where only administrators log in carry less practical risk. The sources do not give the affected version ranges, so check the vendor advisory before deciding who is in scope.
Not affected if managed-hosting, no-local-untrusted-users
Who cares endpoint-protection, local-privilege-escalation, watchguard, windows
Upgrade to 8.00.26.0011
Update WatchGuard Endpoint Security Windows protection to or later ( is the newer release per WatchGuard release notes).
A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.00.26.00118.00.26.0012