WatchGuard Agent Releases

This section provides a release history of the WatchGuard Agent. The WatchGuard Agent is an application you install on endpoints in your network so that WatchGuard Cloud can communicate with them. These products and features use the WatchGuard Agent:

  • WatchGuard Endpoint Security products (Elite, 360, Prime, EDR, Basic) and modules (Patch Management, Full Encryption, Data Control)
  • EDR Core (available with a Firebox Total Security Suite license)
  • WatchGuard Connection Manager for FireCloud
  • Server Gateway for FireCloud
  • ThreatSync+ NDR Collection Agents
  • WatchGuard MDR Log Collector
  • WatchGuard MDR Vulnerability Scanner
  • AuthPoint Logon app

Refer to the Release Notes for each product to review agent changes specific to the product.

For information about new features, download the What's New in WatchGuard Cloud PowerPoint. For a description of the WatchGuard Agent, go to About the WatchGuard Agent in Help Center.

Release Information Date
Latest WatchGuard Agent Update 22 October 2026
Release Notes Revision Date 22 October 2026

Latest Agent Versions

  • Android agent: 3.14.3
  • iOS agent: 2.02.06.0001
  • Windows agent: 1.25.14.0000
  • macOS agent: 1.17.24.0000
  • Linux agent: 1.17.01.0000

Release notes include customer-reported issues that were resolved in this release. Routine internal maintenance, localization updates, and other low-impact changes are not individually documented.

Latest Release

Release Date: 22 October 2026 (Windows Agent v1.25.14.000 and macOS Agent v1.17.24.0000)

Resolved Issues

  • macOS agent v1.17.24.0000 resolves the CVE-2026-96293 vulnerability. This vulnerability could enable the FileVault Personal Recovery Key (PRK) to be written to the agent log directory.
  • macOS agent v1.17.24.0000 resolves an issue that caused Patch Management patch installation errors when the target computer entered sleep mode during the patching process.
  • Windows agent v1.25.14.0000 resolves an issue that caused unexpected restarts of Windows 11 computers during agent uninstallation.
  • Windows agent v1.25.14.0000 resolves an issue that caused computers to restart outside maintenance windows when updates were applied.
  • Windows agent v1.25.14.0000 now enables patches larger than 4 GB to be cached.
  • Windows agent v1.25.14.0000 resolves the CVE-2026-96293 vulnerability. This vulnerability could enable a local user to write, modify, and run files in the agent log directory, altering the logs.

Previous Releases

Resolved Issues

  • Windows agent v1.25.13.0001 resolves an issue that caused the full signature file to repeatedly download after successive failed implementation attempts. The security software cache was optimized to prevent unnecessary network usage.

Resolved Issues

  • Windows agent v1.25.13.0000, macOS agent v1.17.21.0000, and Linux agent v1.17.01.0000 now resolve the CVE-2026-57910 vulnerability.

Enhancements

  • Endpoint Security now supports macOS 27 (Golden Gate). Support requires macOS protection v3.08.00.0002 and macOS agent v1.17.21.0000 or higher.

Resolved Issues

  • macOS agent v1.17.21.0000 and Linux protection v1.17.01.0000 now resolve the CVE-2026-57910 vulnerability. This vulnerability could enable a malicious process with access to a compromised computer on the network to establish fraudulent communications with other computers and perform unauthorized operations on them.

Resolved Issues

  • Windows Agent v1.25.13.000 resolves the CVE-2026-57909 vulnerability, which could enable a malicious process to drop an unauthorized executable file on the computer.
  • Windows Agent v1.25.13.000 resolves the CVE-2026-57910 vulnerability. This vulnerability could enable a malicious process with access to a compromised computer on the network to establish fraudulent communications with other computers and perform unauthorized operations on them.

Resolved Issues

  • macOS Agent v1.17.21.0000 resolves an issue on ARM systems with dark mode enabled where some communication dialog boxes (including installation, Full Encryption configuration, and restart requests) showed incorrectly.
  • macOS Agent v1.17.21.0000 resolves the CVE-2026-57909 vulnerability, which could enable a malicious process to drop an unauthorized executable file on the computer.

Enhancements

Resolved Issues

  • This release resolves BSOD errors caused by the NNSPICC.sys network interception driver.
  • This release resolves an issue that caused continuous restarts of the protection service (PSANHost.exe). This caused the device to temporarily appear as unprotected in the management UI.
  • This release resolves BSOD errors caused by the PSINReg.sys network interception driver when you connected specific dock stations or USB devices.
  • This release resolves BSOD errors caused by a concurrency issue affecting the NNSPRV.sys network interception driver.
  • This release resolves several performance issues.
  • This release resolves an issue in the driver update that prevented the MSI cache from being repaired correctly.
  • This release resolves BSOD errors caused by the PSINKNC.sys driver on computers where there was a large number of running processes that generated multiple input/output operations.
  • We have re-signed Device Control drivers to prevent errors on legacy Windows 10 (th1) systems.
  • This release resolves BSOD errors caused by the PSINFILE.sys driver.
  • We have updated the SQLite3.dll library to resolve vulnerabilities.

Enhancements

  • Version 1.25.12.000 of the Windows Agent includes enhancements for the Endpoint Security modules — Full Encryption and Patch Management. For more information, go to Endpoint Security Platform Release Notes.

Resolved Issues

  • This release resolved an issue where the installer did not request privilege elevation in certain cases, which prevented the application of necessary settings.
  • This release resolved the CVE-2026-41286 vulnerability, which could cause the WatchGuard Agent to crash when it received invalid communications.
  • This release resolved the CVE-2026-41287 vulnerability, which could cause the WatchGuard Agent to crash when it processed certain messages.
  • This release resolved the CVE-2026-41288 vulnerability, which could enable a local user to gain elevated privileges in the system.
  • This release resolved the CVE-2026-6787 vulnerability, which could enable the execution of processes with elevated privileges on the system.
  • This release resolved the CVE-2026-6788 vulnerability, which could enable unauthorized users to gain elevated privileges on the system.

Enhancements

  • Enhancements were made to the Windows agent and the iOS to improve integration with dependent services.

Enhancements

Enhancements

  • With the Linux Agent v1.16.01.0000 you can now deploy and manage the WatchGuard MDR Syslog Collector.

Resolved Issues

  • This release resolves an issue with the YUM package manager that occurred when the security software was upgraded.

New Features

Endpoint Management and Unified Agent Deployment in WatchGuard Cloud

The same WatchGuard Agent can now be installed on endpoints with a license for Endpoint Security products and modules, WatchGuard MDR, and FireCloud. The agent installs the appropriate software on the endpoint based on license availability and the configured installation behavior. The Configure > Agent Deployment page enables Service Providers to specify the agent installation behavior for each of their products. For more information, go to Configure Agent Deployment in Help Center.

In WatchGuard Cloud, the Monitor > Endpoints page lists all endpoints in the account that have the WatchGuard Agent installed. From the Endpoints page, you can see detailed information on the endpoint. For more information, go to Manage Endpoints in WatchGuard Cloud in Help Center.