CVE-2026-41288

HighCVSS 7.8/10Last modified Aug 10, 2026

Description

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
WatchGuardWatchGuard Agent>= 1.0.0.0, < 1.25.03.0000

References

Timeline

Published
May 6, 2026
Last modified
Aug 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-41298.1There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access hoCVE-2026-412927.5NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoCVE-2026-412939.8Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 CVE-2026-412948.6OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variablCVE-2026-412957.8OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during buCVE-2026-412968.2OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows CVE-2026-412977.6OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows CVE-2026-412985.4OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-CVE-2026-412997.1OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields arCVE-2026-41307.1There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with localCVE-2026-413006.5OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. AtCVE-2026-413015.3OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows