WatchGuard Agent Releases

This section provides a release history of the WatchGuard Agent. The WatchGuard Agent is an application you install on endpoints in your network so that WatchGuard Cloud can communicate with them. These products and features use the WatchGuard Agent:

  • WatchGuard Endpoint Security products (Elite, 360, Prime, EDR, Basic) and modules (Patch Management, Full Encryption, Data Control)
  • EDR Core (available with a Firebox Total Security Suite license)
  • WatchGuard Connection Manager for FireCloud
  • Server Gateway for FireCloud
  • ThreatSync+ NDR Collection Agents
  • WatchGuard MDR Syslog Collector
  • AuthPoint Logon app

Refer to the Release Notes for each product to review agent changes specific to the product.

For information about new features, download the What's New in WatchGuard Cloud PowerPoint. For a description of the WatchGuard Agent, go to About the WatchGuard Agent in Help Center.

Release Information Date
Latest WatchGuard Agent Update 30 July 2026
Release Notes Revision Date 30 July 2026

Latest Agent Versions

  • Android agent: 3.14.3
  • iOS agent: 2.02.06.0001
  • Windows agent: 1.25.13.0000
  • macOS agent: 1.17.20.0000
  • Linux agent: 1.17.00.0000

Release notes include customer-reported issues that were resolved in this release. Routine internal maintenance, localization updates, and other low-impact changes are not individually documented.

Latest Release

Release Date: 30 July 2026 (Aether 19.1 Updates)

Enhancements

Resolved Issues

  • This release resolves BSOD errors caused by the NNSPICC.sys network interception driver.
  • This release resolves an issue that caused continuous restarts of the protection service (PSANHost.exe). This caused the device to temporarily appear as unprotected in the management UI.
  • This release resolves BSOD errors caused by the PSINReg.sys network interception driver when you connected specific dock stations or USB devices.
  • This release resolves BSOD errors caused by a concurrency issue affecting the NNSPRV.sys network interception driver.
  • This release resolves several performance issues.
  • This release resolves an issue in the driver update that prevented the MSI cache from being repaired correctly.
  • This release resolves BSOD errors caused by the PSINKNC.sys driver on computers where there was a large number of running processes that generated multiple input/output operations.
  • We have re-signed Device Control drivers to prevent errors on legacy Windows 10 (th1) systems.
  • This release resolves BSOD errors caused by the PSINFILE.sys driver.
  • We have updated the SQLite3.dll library to resolve vulnerabilities.
  • Windows Agent v1.25.13.000 resolves the CVE-2026-57909 vulnerability, which could enable a malicious process to drop an unauthorized executable file on the computer.
  • Windows Agent v1.25.13.000 resolves the CVE-2026-57910 vulnerability. This vulnerability could enable a malicious process with access to a compromised computer on the network to establish fraudulent communications with other computers and perform unauthorized operations on them.

Previous Releases

Enhancements

  • Version 1.25.12.000 of the Windows Agent includes enhancements for the Endpoint Security modules — Full Encryption and Patch Management. For more information, go to Endpoint Security Platform Release Notes.

Resolved Issues

  • This release resolved an issue where the installer did not request privilege elevation in certain cases, which prevented the application of necessary settings.
  • This release resolved the CVE-2026-41286 vulnerability, which could cause the WatchGuard Agent to crash when it received invalid communications.
  • This release resolved the CVE-2026-41287 vulnerability, which could cause the WatchGuard Agent to crash when it processed certain messages.
  • This release resolved the CVE-2026-41288 vulnerability, which could enable a local user to gain elevated privileges in the system.
  • This release resolved the CVE-2026-6787 vulnerability, which could enable the execution of processes with elevated privileges on the system.
  • This release resolved the CVE-2026-6788 vulnerability, which could enable unauthorized users to gain elevated privileges on the system.

Enhancements

  • Enhancements were made to the Windows agent and the iOS to improve integration with dependent services.

Enhancements

Enhancements

  • With the Linux Agent v1.16.01.0000 you can now deploy and manage the WatchGuard MDR Syslog Collector.

Resolved Issues

  • This release resolves an issue with the YUM package manager that occurred when the security software was upgraded.

New Features

Endpoint Management and Unified Agent Deployment in WatchGuard Cloud

The same WatchGuard Agent can now be installed on endpoints with a license for Endpoint Security products and modules, WatchGuard MDR, and FireCloud. The agent installs the appropriate software on the endpoint based on license availability and the configured installation behavior. The Configure > Agent Deployment page enables Service Providers to specify the agent installation behavior for each of their products. For more information, go to Configure Agent Deployment in Help Center.

In WatchGuard Cloud, the Monitor > Endpoints page lists all endpoints in the account that have the WatchGuard Agent installed. From the Endpoints page, you can see detailed information on the endpoint. For more information, go to Manage Endpoints in WatchGuard Cloud in Help Center.