Skip to content

Back to the catalog

ThreatWire (@ThreatWire_) on X
x.comthread

ThreatWire (@ThreatWire_) on X

Post announcing a public PoC for CVE-2026-13043, a critical flaw (CVSS 4.0 9.3, scored by WatchGuard) in PSKMAD, the kernel memory access driver of WatchGuard Endpoint Security on Windows. The access-control handshake can be bypassed (CWE-306/CWE-798), letting a local authenticated attacker send privileged commands and read kernel and other processes' memory. Fixed in 8.00.26.0012; the PoC author and LOLDrivers frame the signed driver as BYOVD material, which WatchGuard does not say. The post notes it is not in CISA KEV, has no reported in-the-wild exploitation, and that ThreatWire has not run the PoC.

TL;DR PoC out for WatchGuard Endpoint Security PSKMAD driver auth-bypass (CVE-2026-13043, CVSS 4.0 9.3); patch to 8.00.26.0012 and block the vulnerable driver.
Open original ↗

Organisations named here

  • PSKMAD
  • ThreatWire

CVEs named here

  • CVE-2026-13043

Technologies named here

  • WatchGuard Endpoint Security on Windows
  • Public proof of concept for CVE-2026-13043
  • ThreatWire full breakdown
  • Windows
  • CVSS
  • Missing Authentication for Critical Functionality
  • LOLDrivers
  • CISA KEV
  • WatchGuard Endpoint Security

Techniques named here

  • Use of Hard-coded Credentials
  • BYOVD

Related in Offensive Security