# WatchGuard Endpoint: local users can reach SYSTEM privileges Canonical: https://www.oktsec.com/radar/watchguard-endpoint-cve-2026-57907 Publisher: Oktsec Language: en Published: 2026-11-12T23:07:39Z Updated: 2026-11-12T23:07:39Z Record reviewed: 2026-11-12T23:07:39Z Latest evidence check: 2026-11-12T23:07:39Z Disclosed: 2026-11-10 WatchGuard fixed a local privilege escalation in communication between its protection console and service. A user already authenticated on the Windows host can obtain SYSTEM code execution. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The vendor provides 8.00.26.0011 for Windows protection. Exploitation requires an authenticated local user; the notice does not establish actual attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Account access required - Vendor: WatchGuard - Products: Endpoint Security for Windows - CVEs: CVE-2026-57907 ## Technical overview WatchGuard’s November 10 advisory describes CVE-2026-57907 in communication between the protection console and its privileged service. A local user with low privileges can inject code into the trusted console and issue privileged commands, resulting in execution as SYSTEM. The attack requires an authenticated local user. This is not an unauthenticated attack against an internet service. The vendor lists Windows Endpoint Security versions before 8.00.26.0011 as affected and that version as corrected. The notice does not report exploitation in actual attacks. Oktsec recommends checking protection versions on endpoints themselves, including offline devices and systems with failed upgrades. Updating a management interface does not establish that every endpoint received the correction. Investigate unexpected privileged activity using the organization’s normal response process. ## Recommended response Update affected Windows endpoint protection to 8.00.26.0011 or a later corrected release. Verify the installed protection version on each endpoint. Relevant to: Administrators of Windows endpoints protected by WatchGuard Endpoint Security. ## CVE attribution - CVE-2026-57907: WatchGuard — Endpoint Security for Windows. [Source](https://psirt.watchguard.com/CVE-2026-57907) ## Affected systems and fixes ### Endpoint Security for Windows Affected: Versions before 8.00.26.0011; requires a local authenticated user with low privileges. Fixed release / action: 8.00.26.0011 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T01:29:19.779Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T01:30:03.234Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-57907](https://api.first.org/data/v1/epss?cve=CVE-2026-57907): 0.13% probability of observed exploitation in the next 30 days; percentile 2.73%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T01:30:03.234Z. ### Official regional advisories - [Vulnerabilidad en productos WatchGuard](https://www.cert.gov.py/vulnerabilidad-en-productos-watchguard-6/) — CERT-PY, Paraguay; publication 2026-11-12T13:00:01.000Z; observed 2026-11-13T01:30:03.234Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Identify affected Windows endpoints** — Oktsec recommends recording the installed protection version and update health, including offline or unmanaged exceptions. 2. **Deploy the corrected protection release** — Update affected endpoints to 8.00.26.0011 or a later corrected version through the supported WatchGuard process. 3. **Confirm endpoint installation** — Oktsec recommends verifying the installed version on each device and assigning an owner to failed upgrades; a console deployment request is not proof of installation. ## Relevance to AI environments Windows hosts that run agent tools or build jobs share the local privilege boundary described here. Oktsec recommends verifying the protection agent on those hosts; this is not evidence of a vulnerability in an AI model. ## Sources - [Endpoint Protection console and service privilege escalation](https://psirt.watchguard.com/CVE-2026-57907) — WatchGuard; Vendor notice; checked 2026-11-12T23:03:52Z ## Editorial record - 2026-11-12T23:07:39Z: Added verified prerequisites, affected versions, correction scope and operational checks. Actual attacks are not established by the reviewed sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/watchguard-endpoint-cve-2026-57907) · [Build a response plan](https://www.oktsec.com/radar/watchguard-endpoint-cve-2026-57907#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=watchguard-endpoint-cve-2026-57907&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=watchguard-endpoint-cve-2026-57907&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.