The WatchGuard Agent on Windows contains an incorrect permission assignment in its patch management component that allows an authenticated local user to elevate privileges to NT AUTHORITY\\SYSTEM. This privilege escalation flaw is identified as CWE‑732. An attacker who can authenticate locally can gain full system control, compromising the confidentiality, integrity, and availability of the affected system.

The vulnerability affects installations of the WatchGuard Agent on Windows. No specific product versions are listed in the advisory, so all versions of the agent that include the vulnerable patch management component are potentially impacted.

The CVSS score of 7.3 labels the flaw as high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the requirement for local authentication means that insider or compromised local accounts present a significant risk. Exploitation requires the attacker to be an authenticated local user who can access the patch management component; once the flaw is leveraged, the attacker can obtain SYSTEM privileges.