CVE-2026-13043 is a high severity missing authentication flaw in the kernel memory access driver (PSKMAD) used by WatchGuard endpoint security products on Windows. A local authenticated attacker can issue privileged commands to the driver and read memory. WatchGuard rates it Critical. The fix is version 8.00.26.0012 or later.
What's affected
- WatchGuard Endpoint Security on Windows, all versions before 8.00.26.0012, per WatchGuard's advisory.
- Fixed: 8.00.26.0012 and later.
- Workaround: none listed. The advisory recommends updating.
Source conflict on severity: the CVE record scores this 8.8 High (vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). WatchGuard's advisory rates it Critical with a CVSS 4.0 score of 9.3. The two scores use different CVSS versions, and the vendor rating is the higher one. Treat it as urgent.
How to check if you're exposed
Find the installed endpoint agent version on your Windows fleet from the management console, or on a single host:
Get-CimInstance Win32_Product | Where-Object Name -match 'WatchGuard' | Select-Object Name, Version
Win32_Product queries can be slow and are not available everywhere, so your endpoint management tool is the better source. Anything below 8.00.26.0012 is affected. The driver runs in the kernel, so the version matters on every managed Windows machine, not just servers.
What to do now
- List managed Windows hosts running WatchGuard Endpoint Security and their versions.
- Roll out 8.00.26.0012 or later through the management console.
- Check that removable or offline machines also receive the update.
- Review local administrator and standard user lists on sensitive hosts, since the attacker needs a local account.
- Verify the version after rollout with the same inventory source.
Why it matters
The record lists two weakness classes: CWE-306 (Missing Authentication for Critical Function) and CWE-798 (Use of Hard-coded Credentials). The advisory says the driver has an access control handshake that a local attacker can bypass, and then issue privileged commands that disclose kernel and process memory.
Drivers run with the highest privileges on a machine, so a gap in how they authenticate callers matters. A security product that includes a kernel memory driver is a trusted component, which makes it an attractive target. The record does not list this as exploited in the wild, and it is not in the CISA KEV catalog. The vector's changed scope reflects that impact crosses out of the driver.
Fleet size is the practical challenge with endpoint agents. A rollout in rings, starting with IT and high value machines, shows quickly whether the new agent version causes problems, and a final inventory pass catches laptops that were offline during the rollout.
Quick check
Does the attacker need to be on the network?
No. The attacker is local and authenticated, per the advisory.
What does exploitation disclose?
The advisory says kernel and process memory.
Sources
Last reviewed: 18 October 2026.
