Missing Authorization Vulnerability in WatchGuard's wgagent Management Daemon
CVE-2026-90441

7.1HIGH

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-90441?

A vulnerability exists in the wgagent management daemon that stems from missing authorization controls during session initialization. This flaw permits authenticated users, including those with low privileges such as guest administrator accounts, to exploit the management API. By crafting a specific request, an attacker can crash the wgagent process and gain unauthorized access to sensitive files that the daemon can access. This potentially exposes critical information and highlights a significant security risk for affected systems.

Affected Version(s)

Fireware OS Default 2026.3 < 2026.3.2

Fireware OS Default 2025.0 < 2026.2.3

Fireware OS Default 12.0 < 12.12.3

References

https://psirt.watchguard.com/CVE-2026-90441
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WatchGuard AI Security Research
.