CVE-2026-13043: WatchGuard PSKMAD Auth Bypass Vulnerability

CVE-2026-13043 is an authentication bypass flaw in WatchGuard endpoint security products that allows local attackers to issue privileged commands to the PSKMAD driver, exposing kernel and process memory. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-13043 Overview

CVE-2026-13043 is a missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) shipped with WatchGuard endpoint security products. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands directly to the driver. Successful exploitation discloses kernel memory and arbitrary process memory. The weakness is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
An authenticated local user can bypass the PSKMAD driver handshake, read kernel and process memory, and extract credentials, keys, or other sensitive data from the host.

Affected Products

WatchGuard endpoint security products using the Kernel Memory Access Driver (PSKMAD)
Refer to the WatchGuard CVE-2026-13043 Advisory for the authoritative list of affected versions

Discovery Timeline

2026-10-01 - CVE-2026-13043 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-13043

Vulnerability Analysis

The PSKMAD driver exposes a privileged I/O control interface used by WatchGuard endpoint components to read kernel and process memory. Access to that interface is gated by a handshake routine intended to restrict callers to authorized user-mode services. The handshake does not sufficiently authenticate the caller, which allows any local authenticated process to interact with the driver as if it were a trusted component.

Once the handshake is bypassed, the attacker can submit the same privileged I/O control codes that the legitimate agent uses. These codes return the contents of kernel memory and arbitrary process address space. The impact extends beyond information disclosure, because leaked kernel structures and credential material enable follow-on privilege escalation and lateral movement.

Root Cause

The root cause is a missing authentication check on a critical function [CWE-306]. The driver treats a client that completes the handshake as authorized without verifying the caller's identity, signature, or integrity. Any local process with the ability to open the driver's device object can replay or bypass the handshake and reach the privileged command surface.

Attack Vector

Exploitation requires local access and valid credentials on the host. The attacker opens the PSKMAD device, performs or bypasses the handshake, and issues I/O control requests that direct the driver to read targeted memory ranges. No user interaction is required. See the WatchGuard CVE-2026-13043 Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-13043

Indicators of Compromise

Unexpected processes opening a handle to the PSKMAD driver device object outside of the signed WatchGuard agent service
Non-WatchGuard binaries issuing DeviceIoControl calls to the PSKMAD device
Memory-scraping tooling or LSASS access attempts correlated with PSKMAD handle acquisition

Detection Strategies

Alert on handle opens to the PSKMAD device from any process whose image path or signer is not the expected WatchGuard service binary
Baseline legitimate IOCTL traffic to PSKMAD and flag deviations in volume, call frequency, or source process
Correlate PSKMAD interaction events with subsequent credential access or privilege escalation behaviors

Monitoring Recommendations

Enable kernel driver and device object access auditing on endpoints running WatchGuard products
Forward driver access telemetry to a central analytics platform for cross-host correlation
Monitor for new or unsigned user-mode binaries that import memory-reading APIs on hosts with PSKMAD installed

How to Mitigate CVE-2026-13043

Immediate Actions Required

Inventory endpoints running WatchGuard products that install the PSKMAD driver
Apply the fixed version identified in the WatchGuard CVE-2026-13043 Advisory as soon as it is available in your environment
Restrict local interactive and remote login rights on affected hosts to reduce the pool of users who can reach the local attack surface
Rotate credentials and secrets handled on hosts where unauthorized PSKMAD access is suspected

Patch Information

WatchGuard has published guidance for CVE-2026-13043 in its PSIRT advisory. Administrators should consult the WatchGuard CVE-2026-13043 Advisory for fixed version numbers, upgrade procedures, and any product-specific caveats.

Workarounds

Enforce least privilege and strong authentication on all accounts that can log in locally to affected hosts
Use application control to block unauthorized binaries from executing on hosts that run the PSKMAD driver
Where patching is delayed, isolate or decommission high-value hosts that cannot be upgraded promptly

bash

# Configuration example
# Refer to the WatchGuard PSIRT advisory for official remediation steps:
# https://psirt.watchguard.com/CVE-2026-13043