EUVD-2026-41448
GHSA-vxh9-mg9h-h952
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to store the payload; scope change applies as victim's browser session is impacted; no availability effect; low C/I reflecting typical stored XSS session impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936.
This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored XSS in WatchGuard Fireware OS's Tigerpaw Technology Integration module allows a high-privileged attacker to persist malicious scripts within the management interface, which then execute in the browsers of other authenticated users who visit the affected pages. Critically, this CVE is identified as an additional unmitigated attack path for CVE-2025-13936, indicating an incomplete remediation of a prior related XSS flaw in the same integration module. Affected versions span the 12.4, 12.5, and 2025.x/2026.x release trains; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
WatchGuard Fireware OS is the operating system powering WatchGuard Firebox network security appliances. The Tigerpaw Technology Integration module is a business management software connector embedded within Fireware OS, used to link network device management with IT service management workflows. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored XSS variant, meaning attacker-supplied input is persisted server-side and rendered without sanitization in subsequent page loads. The CPE cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:* covers all WatchGuard Fireware OS versions, with the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirming the impact is confined to the subsequent system (victim's browser session) with SC:L/SI:L - meaning confidentiality and integrity of the subsequent system (the browser/session context) are marginally affected. The connection to CVE-2025-13936 suggests the original fix was partial, and this represents a bypass or overlooked injection point within the same module.
RemediationAI
The primary remediation is to apply any patched Fireware OS version released by WatchGuard addressing WGSA-2026-00015, available at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00015. No specific fix version number is confirmed in the available data - consult the advisory directly for the exact target version before upgrading. As a compensating control pending patching, organizations should disable or restrict access to the Tigerpaw Technology Integration module if it is not operationally required, as this eliminates the exposed attack surface entirely. Additionally, limiting management interface access to trusted administrator accounts via role-based access controls reduces the pool of users capable of injecting a stored payload. Note: because this is an additional attack path to CVE-2025-13936, environments that previously patched only for that CVE should treat this as a new, separate remediation requirement.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially cra
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today