CVE WatchSep 30, 2026

CVE-2026-90441

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Sep 30, 2026 · Last modified: Sep 30, 2026 · CWE-200 · CWE-400 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

Official references

psirt.watchguard.comhttps://psirt.watchguard.com/CVE-2026-90441

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-972855.4 MED

—

———Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.6h CVE-2026-972674.3 MED

—

———Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.6h CVE-2026-972476.5 MED

—

———Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.6h CVE-2026-972435.4 MED

—

———Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.6h CVE-2026-972396.5 MED

—

———Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.6h CVE-2026-971977.5 HIG

—

———Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.6h