Fireware OS CVE-2026-13371

Q: What is the CVSS score of CVE-2026-13371?

CVE-2026-13371 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41447 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-07-02 WatchGuard

GHSA-hprc-6hj7-jj8j

Deserialization Fireware Os Watchguard

6.9

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Admin authentication (PR:H) is explicitly required per description; availability-only crash impact (A:H) with no confidentiality or integrity loss (C:N/I:N).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:58 vuln.today

DescriptionCVE.org

An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.

AnalysisAI

Denial-of-service in WatchGuard Fireware OS Management Web UI allows an authenticated administrator to crash the management service by submitting crafted input to the put_data endpoint, which performs unsafe deserialization of attacker-controlled data (CWE-502). The CVSS 4.0 vector (PR:H, VA:H) confirms that exploitation is restricted to administrator-level accounts and results in availability loss only - no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the insider-threat and compromised-credential risk category.

Technical ContextAI

WatchGuard Fireware OS is the purpose-built operating system powering WatchGuard Firebox and related network security appliances, providing UTM, firewall, and VPN capabilities. The Management Web UI is the browser-based administrative plane for these devices. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the put_data endpoint accepts external input and passes it into a deserialization routine without adequate validation or type-checking. When malformed or specially crafted serialized objects are submitted, the deserialization process cannot safely handle the payload and crashes the management service. The CPE string cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor has not yet narrowed the affected range in NVD data - exact impacted versions must be confirmed via the WatchGuard PSIRT advisory.

RemediationAI

Consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00014 for the specific patched Fireware OS version and upgrade instructions - exact fix version numbers are not independently confirmed from the available data. As a compensating control, restrict access to the Fireware Management Web UI exclusively to trusted management networks or dedicated jump hosts using firewall ACLs, preventing external network sessions from reaching the endpoint even with valid credentials; the trade-off is reduced flexibility for remote administration. Enforce multi-factor authentication (MFA) on all administrator accounts to reduce the probability that compromised credentials can be used to trigger the DoS; this does not eliminate the vulnerability but significantly raises the bar for exploitation. Audit and minimize the number of accounts holding administrator-level privileges to shrink the credential-compromise attack surface.