WatchGuard Agent Flaws Enable Unauthenticated Code Execution on

🕵️ RESEARCH & DEEP DIVES

• Study finds LLM agents overshare private data in most tool calls
  A study finds that LLM agents often overshare private data in tool calls.
  • LLM agents using third-party tools are affected by the privacy exposure.
  • Tool-call arguments included unnecessary privacy-sensitive data in 81–88% of calls from GPT-4o, Claude 3.5 Sonnet, and Llama-3.3-70B.
  • Explicit privacy instructions still left 36–76% of calls oversharing data.
  • Implicit privacy signals, such as a hospital name implying a diagnosis, can evade PII detectors.
  • The proposed ToolMinimize middleware intercepts and rewrites tool-call arguments.
    📄 Source: arxiv.org · 📎 Coverage: arxiv.org · 👁 via arXiv cs.CR

📋 ADVISORIES

• WatchGuard Agent Flaws Enable Unauthenticated Code Execution on Windows CVE-2026-57909 CVE-2026-57910
  WatchGuard disclosed two critical vulnerabilities in its Windows Agent.

  • WatchGuard Agent for Windows versions earlier than 1.25.13.0000 are affected.
  • CVE-2026-57910 and CVE-2026-57909 carry CVSS v4.0 scores of 9.3 and 9.4.
  • CVE-2026-57910 abuses the UDP discovery and command service to trigger TaskExecute and run downloaded attacker-controlled code.
  • CVE-2026-57909 is a path-traversal flaw enabling unauthenticated remote code execution from an adjacent network.
  • Successful exploitation can provide elevated SYSTEM-level control of the Windows endpoint.
    📄 Source: psirt.watchguard.com · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

• 📄 Source for Adobe Campaign Classic flaws enable unauthenticated arbitrary code execution — helpx.adobe.com

• 📄 Source for Chinese state-linked groups more than double attacks with open-source AI — deepseek.com

🔓 CVEs & KEV

• CVE-2026-80214 — CVSS 8.6 — LibreNMS Virtualisation Discovery Module RCE

• LibreNMS’s Virtualization Discovery Module contains a remote code execution vulnerability.