Uncontrolled Search Path Element in the WatchGuard Agent’s PluginLauncher enables an attacker to supply a malicious file and have it executed with SYSTEM privileges. If the attacker can place a crafted executable in a directory that the launcher searches, the Agent will run it, leading to full control of the compromised Windows machine. The flaw is a classic code execution vulnerability that threatens confidentiality, integrity, and availability of the affected system, as it grants an attacker the highest local privilege level.

The vulnerability affects WatchGuard Agent for Windows versions prior to 1.25.03.0000. All installations of the WatchGuard Agent before this release that rely on the default PluginLauncher configuration are at risk, regardless of the operating system patch level.

The CVSS score of 8.5 indicates a high severity flaw. The EPSS value is not available, so the exact exploitation probability is unknown, but the lack of a KEV listing does not reduce the urgency of patching. The most likely attack scenario requires the attacker to supply a malicious file that the PluginLauncher will execute; thus, the vector is inferred to be local privilege escalation through an unverified file path. Given the potential for SYSTEM‑level execution, the risk is significant and warrants immediate remediation.