CVE-2026-13043

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306 CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130467.2A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacke CVE-2026-130488.2Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load CVE-2026-13055.3The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is CVE-2026-130507.2An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbi CVE-2026-130519.1Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustio CVE-2026-130537.2An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code CVE-2026-130547.2A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary CVE-2026-130556.5The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fai CVE-2026-130566.5Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing CVE-2026-130576.5An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies,CVE-2026-130586.5An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction comm CVE-2026-130598.1An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level a