Security readout for executives and security teams
Plain-English summary
WatchGuard Agent 1.0.0.0 for Windows contains a hard-coded cryptographic key. A locally authenticated attacker with low privileges could use this weakness to insert code into an existing process, potentially compromising data confidentiality, integrity, and availability without user interaction.
Executive priority
Treat this as a high-priority endpoint remediation issue, especially where version 1.0.0.0 is widely deployed or local access is weakly controlled. It is not currently supported as an emergency active-exploitation event, but its high potential impact warrants prompt inventory, vendor-guided remediation, and validation.
Technical view
CVE-2026-6787 is a CWE-321 hard-coded cryptographic key vulnerability in WatchGuard Agent 1.0.0.0 on Windows. Its CVSS 4.0 score is 8.5. The vector indicates local access, low complexity, low privileges, no user interaction, and high impact to the vulnerable system.
Likely exposure
Exposure is limited to Windows systems running WatchGuard Agent version 1.0.0.0 according to the supplied record. Exploitation requires local access and low privileges, so compromised accounts, malware, or shared endpoint access could increase risk. The bundle marks other versions unaffected by default but provides no deployment prevalence.
Exploitation context
The supplied CVE record is not listed in CISA KEV, and the provided sources do not report active exploitation or public exploit availability. Exploitation is described as local, low-complexity, and requiring low privileges, with no user interaction. Evidence about attack chains and observed incidents is incomplete.
Researcher notes
The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The public description does not explain key usage, affected process boundaries, prerequisites beyond local low privileges, indicators, proof-of-concept status, or a fixed version. Avoid inferring remote exploitability or broader affected versions.
Mitigation direction
- Inventory Windows endpoints and identify WatchGuard Agent version 1.0.0.0.
- Consult WatchGuard advisories for the supported remediation or fixed release.
- Prioritize remediation on shared endpoints and systems exposed to untrusted local users.
- Restrict unnecessary local access until WatchGuard's remediation is applied.
- Maintain endpoint monitoring for unexpected process modification or code loading.
Validation and detection
- Confirm installed WatchGuard Agent versions using trusted endpoint inventory data.
- Verify remediated systems no longer run version 1.0.0.0.
- Review WatchGuard advisories for updated affected-version and remediation information.
- Examine endpoint telemetry for unusual code loading within WatchGuard Agent processes.
- Document systems where remediation cannot yet be completed and apply compensating access controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-321: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-6787 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——WatchGuardVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.watchguard.com/CVE-2026-6787CVE reference, WatchGuard · vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/WGSA-2026-00013CVE reference, WatchGuard · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.