WatchGuard Endpoint Security: Missing authentication in kernel memory access driver

Summary

The Kernel Memory Access Driver (PSKMAD) used by WatchGuard Endpoint Security on Windows lacks authentication for a critical function. A local attacker with low privileges can bypass the driver's access-control handshake and send arbitrary privileged commands to it. This can disclose kernel and process memory, which may expose credentials, tokens and keys.

Affected

• WatchGuard Endpoint Security on Windows, versions from 0 up to but not including 8.00.26.0012
• Unknown: Panda Dome and other Panda consumer products, and their fixed versions

Fixed in

• Windows protection 8.00.26.0012 or later (vendor advisory, release dated October 1, 2026)

Workaround

• Where operationally feasible, block the vulnerable driver after confirming compatibility and testing endpoint protection, because blocking a security driver can break protection
• Monitor for unusual access to the driver's device interface and for suspicious process-memory access
• Ordinary process-level access controls may not stop the memory exposure, as the driver is signed by Microsoft's Hardware Compatibility Publisher

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV
• CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total
• A public write-up with proof of concept exists (Exploit Pack); it was demonstrated on a fully patched Windows 11 system with VBS/HVCI enabled

Our recommendation

• Update Endpoint Security on all Windows endpoints to 8.00.26.0012 or later
• Check the Endpoint Security version on each device and look for the affected driver
• Prioritise endpoints where users could run local code, for example through phishing or macros
• Confirm that managed-service provider fleets are updated
• Monitor for suspicious access to the driver and process-memory collection

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  TheMalwareGuardian/CVE-2026-13043

Research sources

• WatchGuard PSIRT advisory CVE-2026-13043 psirt.watchguard.com
• Exploit Pack research write-up www.exploitpack.com
• GBHackers report gbhackers.com
• CyberPress report cyberpress.org
• WindowsForum release note summary windowsforum.com
• Canadian Cyber Centre notice AV26-990 (via malware.news) malware.news
• OpenCVE CVE-2026-13043 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:40.