{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Endpoint Security","source":"CNA: WatchGuard","vendor":"WatchGuard","versions":[{"lessThan":"8.00.26.0011","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-57907","cwes":["CWE-269"],"description":"A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: WatchGuard","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794330109222,"publishedAt":1794328920448,"references":[{"source":"CNA: WatchGuard","tags":["vendor-advisory"],"url":"https://psirt.watchguard.com/CVE-2026-57907"}],"remediation":[],"revision":"e6845bcc385072ed8a7f6e61e6965839eb4488953a6435db37b91c96cbbf194c","sources":[{"modifiedAt":1794330109222,"name":"CNA: WatchGuard","retrievedAt":1794330806995,"url":"https://www.cve.org/CVERecord?id=CVE-2026-57907"}],"ssvc":{"assessedAt":1794330097192,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution","updatedAt":1794330806995}