CVE-2026-41288 HIGH

CVE-2026-41288: WatchGuard Agent on Windows Privilege Escalation Vulnerability

Vendor Watchguard

Product WatchGuard Agent

Weakness CWE-732

Published May 6, 2026

Last update May 6, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.

Key dates

02Disclosure timeline

May 6, 2026 CVE published

May 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41288 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/732.html

Related vulnerabilities

04Related CVE

CVE-2023-4332 Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file CVE-2023-32162 Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability CVE-2025-41659 CODESYS Control PKI Exposure Enables Remote Certificate Access CVE-2022-22521 Privilege Escalation in Miele Benchmark Programming Tool CVE-2026-42937 iControl REST and tmsh vulnerability