{"id":"CVE-2026-57907","kind":"vulnerability","aliases":["CVE-2026-57907"],"related":[],"title":"WatchGuard Endpoint Protection: local user can gain SYSTEM privileges","description":"A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service.","summary":"A flaw in how WatchGuard Endpoint Protection's console and protection service talk to each other lets a low-privileged local user inject code into the trusted console process. From there the user can send privileged commands to the service and run arbitrary code with SYSTEM rights.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WatchGuard Endpoint Protection","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"WatchGuard Endpoint Security (Windows protection)","fixed":["8.00.26.0011"],"affected":">= 0, < 8.00.26.0011","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoint-protection","local-privilege-escalation","vendor","watchguard","windows"],"not_affected_if":["managed-hosting","no-local-untrusted-users"],"how_to_check":"- On each Windows endpoint, check the installed WatchGuard Endpoint Security protection version (About screen or installed programs list). Versions below 8.00.26.0011 are affected.\n- In the WatchGuard Cloud console, check the protection version reported per computer.","fix":"Update WatchGuard Endpoint Security Windows protection to 8.00.26.0011 or later (8.00.26.0012 is the newer release per WatchGuard release notes).","status":"open","published_at":"2026-11-10T17:17:44+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:23:51+00:00","updated_at":"2026-11-10T17:25:13+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-11-10T17:23:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"WatchGuard Endpoint Protection: local user can gain SYSTEM privileges","impact":"high","summary":"A flaw in how WatchGuard Endpoint Protection's console and protection service talk to each other lets a low-privileged local user inject code into the trusted console process. From there the user can send privileged commands to the service and run arbitrary code with SYSTEM rights.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","watchguard","endpoint-protection"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privileged user runs code as SYSTEM","analyst_note":"Find affected and fixed versions and the vendor advisory for CVE-2026-57907 at the WatchGuard security portal; sources give none.","how_to_check":"- Check the installed WatchGuard Endpoint Protection version in the product's About or Help screen on each endpoint, or in the installed programs list.\n- Compare the version against the fixed release in the vendor advisory: unknown from these sources.","plain_action":"","product_name":"WatchGuard Endpoint Protection","needs_analyst":true,"not_affected_if":["no-local-untrusted-users","managed-hosting"],"who_is_affected":"Any Windows machine running WatchGuard Endpoint Protection where ordinary users can log in locally is exposed, since the attacker only needs a low-privileged local account. Servers and endpoints where only administrators log in carry less practical risk. The sources do not give the affected version ranges, so check the vendor advisory before deciding who is in scope.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4553,"output_tokens":618,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed versions and the vendor advisory for CVE-2026-57907 at the WatchGuard security portal; sources give none.","search":"'-2026':11A,14A '-57907':12A,15A 'allow':102C 'arbitrari':77B,112C 'authent':108C 'code':58B,78B,113C,119C 'command':71B,128C 'communic':94C 'consol':42B,62B,97C,123C 'cve':10A,13A 'endpoint':2A,17A,20A,25B,39B,88C 'endpoint-protect':24B 'escal':30B,84C 'execut':111C 'flaw':35B 'gain':7A 'inject':57B,118C 'inter':92C 'inter-process':91C 'issu':126C 'let':50B 'local':4A,28B,55B,104C 'local-privilege-escal':27B 'low':53B,106C 'low-privileg':52B,105C 'privileg':9A,29B,54B,70B,83C,107C,116C,127C 'process':63B,93C,124C 'protect':3A,26B,40B,44B,89C,100C 'protection':18A,23A 'right':81B 'run':76B 'security':21A 'send':69B 'servic':45B,74B,101C,131C 'system':8A,80B,115C 'talk':46B 'trust':61B,122C 'user':5A,56B,67B,109C 'vendor':31B 'vulner':85C 'watchguard':1A,16A,19A,32B,38B,87C 'window':33B 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine running WatchGuard Endpoint Protection where ordinary users can log in locally is exposed, since the attacker only needs a low-privileged local account. Servers and endpoints where only administrators log in carry less practical risk. The sources do not give the affected version ranges, so check the vendor advisory before deciding who is in scope.","tier":"B","verified":{"fix":{"at":"2026-11-10T17:25:13Z","by":"analyst","doc":"https://psirt.watchguard.com/","run_id":2474}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["endpointprotection","endpointsecuritywindowsprotection","watchguardendpointprotection","watchguardendpointsecuritywindowsprotection"],"ptokens":["endpoint","protection","security","watchguard","windows"],"labels":["endpointprotection","high","localprivilegeescalation","vendor","watchguard","windows"],"campaign_type":null,"search_a":"'-2026':11A,14A '-57907':12A,15A 'cve':10A,13A 'endpoint':2A,17A,20A 'gain':7A 'local':4A 'privileg':9A 'protect':3A 'protection':18A,23A 'security':21A 'system':8A 'user':5A 'watchguard':1A,16A,19A 'windows':22A","search_b":"'arbitrari':77B 'code':58B,78B 'command':71B 'consol':42B,62B 'endpoint':25B,39B 'endpoint-protect':24B 'escal':30B 'flaw':35B 'inject':57B 'let':50B 'local':28B,55B 'local-privilege-escal':27B 'low':53B 'low-privileg':52B 'privileg':29B,54B,70B 'process':63B 'protect':26B,40B,44B 'right':81B 'run':76B 'send':69B 'servic':45B,74B 'system':80B 'talk':46B 'trust':61B 'user':56B,67B 'vendor':31B 'watchguard':32B,38B 'window':33B","search_c":"'allow':102C 'arbitrari':112C 'authent':108C 'code':113C,119C 'command':128C 'communic':94C 'consol':97C,123C 'endpoint':88C 'escal':84C 'execut':111C 'inject':118C 'inter':92C 'inter-process':91C 'issu':126C 'local':104C 'low':106C 'low-privileg':105C 'privileg':83C,107C,116C,127C 'process':93C,124C 'protect':89C,100C 'servic':101C,131C 'system':115C 'trust':122C 'user':109C 'vulner':85C 'watchguard':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57907","severity":null,"published_at":"2026-11-10T17:17:44+00:00","modified_at":"2026-11-10T17:17:44+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57907:2474","url":"https://psirt.watchguard.com/","severity":null,"published_at":"2026-11-10T17:25:13+00:00","modified_at":"2026-11-10T17:25:13+00:00","first_seen_at":"2026-11-10T17:25:13+00:00","fetched_at":"2026-11-10T17:25:13+00:00","note":"WatchGuard PSIRT portal lists CVE-2026-57907 (CVSS 8.5, published 2026-11-10): Endpoint Security (Windows protection) < 8.00.26.0011 affected, >= 8.00.26.0011 fixed. Portal row only; detail page not read. Later release notes list 8.00.26.0012 as newer Windows protection. No exploitation or PoC info found.","cites":["https://psirt.watchguard.com/"]}],"documents":[{"id":6985,"url":"https://psirt.watchguard.com/","title":"WatchGuard Security Advisories (CVE-2026-57907 row)","kind":"advisory","source":"analyst","publisher":null,"text":"WatchGuard PSIRT index row (psirt.watchguard.com, fetched 2026-10-27):\nSeverity 7.2 | CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | Affected: Default >= 2025.1, < 2026.4; >= 12.0, < 12.12.4. T15/T35 >= 12.0, < 12.5.22. Fixed: >= 2026.4, >= 12.12.4; T15/T35 >= 12.5.22 | Published 2026-10-27\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}