Which versions of Fireware OS are affected by CVE-2026-13053?

WatchGuard Fireware OS contains a high-severity vulnerability affecting the most widely deployed versions (11.0-11.12.4_Update1, 12.0-12.12, 2025.1-2026.2) that could allow compromised administrator…

How to fix or mitigate CVE-2026-13053?

Within 24 hours: Audit all WatchGuard Fireware deployments to identify affected versions; restrict CLI administrative access to dedicated jump hosts or hardened networks only; enable comprehensive CLI command logging. Within 7 days: Contact WatchGuard support for interim mitigations and patch timelines; review and reduce administrative account privileges to least-privilege model; implement behavioral monitoring for suspicious CLI activity. Within 30 days: Deploy vendor patches immediately upon release; conduct forensic review of administrative access logs for unauthorized activity; evaluate network segmentation or failover architecture if patches remain unavailable.

Fireware OS CVE-2026-13053

Q: What is the CVSS score of CVE-2026-13053?

CVE-2026-13053 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41463 HIGH

Out-of-bounds Write (CWE-787)

2026-07-02 WatchGuard

GHSA-mh9h-xjv7-9f27

RCE Buffer Overflow Memory Corruption Fireware Os Watchguard

8.6

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Privileged admin CLI access required (PR:H) over the network management interface (AV:N) with low complexity and no user interaction; code execution yields full C/I/A impact confined to the appliance (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:54 vuln.today

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Authenticated command execution in WatchGuard Fireware OS lets a privileged administrator escalate a specially crafted CLI command into arbitrary code execution via an out-of-bounds write (CWE-787). The flaw affects a very broad version span (Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2), placing most currently and historically deployed WatchGuard Firebox appliances in scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 score of 8.6 reflects full confidentiality/integrity/availability impact once the required privileged access is obtained.

Technical ContextAI

Fireware OS is the embedded operating system running on WatchGuard Firebox network security appliances (firewall/VPN gateways), and the affected component is its command-line interface (CLI) used for device administration. The root cause is CWE-787 (Out-of-bounds Write): the CLI command handler writes attacker-influenced data past the bounds of an allocated buffer, corrupting adjacent memory. On an embedded appliance OS this memory corruption can be steered into control-flow hijacking, turning a text CLI command into native code execution in the context of the management process. The single CPE, cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*, confirms Fireware OS itself as the vulnerable software with all listed version ranges affected.

RemediationAI

Patch available per vendor advisory: consult WatchGuard PSIRT advisory WGSA-2026-00030 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00030) for the fixed Fireware OS build and upgrade to a release beyond the affected 2026.2 / 12.12 / 11.12.4_Update1 ceilings for your branch - an exact fix version is not stated in the available data, so do not assume a version number. Because exploitation requires privileged CLI access, the strongest compensating controls until patching are to restrict and harden administrative access: limit the management/CLI interface to a dedicated management VLAN or trusted admin hosts only (side effect: remote admins must connect via VPN or a jump host), enforce multi-factor authentication and strong unique credentials on all Firebox admin accounts to reduce credential-theft pivots, minimize the number of accounts holding full privileged CLI rights and review role assignments, and monitor CLI/audit logs for anomalous or malformed administrative commands. These controls limit who can reach the vulnerable code path but do not remove the flaw, so patching remains the primary fix.