The vulnerability exists because WatchGuard Agent uses a hard‑coded cryptographic key, allowing an attacker to inject arbitrary code into the existing agent process. This flaw permits code execution with the privileges that the agent runs under. The weakness is classified as CWE‑321, indicating insecure key management.

Versions of WatchGuard Agent for Windows that are older than 1.25.03.0000 are affected. All installations of the single WatchGuard Agent product distributed by WatchGuard prior to this release are susceptible.

The CVSS score of 8.5 reflects a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of those metrics does not lower the risk. Based on the description, the likely attack vector is the delivery of a specially crafted payload that exploits the hard‑coded cryptographic key to evade integrity checks; the attack could be local or remote, depending on the agent’s network exposure. The exploitation would require the attacker to gain access to the agent’s input channel.