EUVD-2026-41449
GHSA-vjhv-mh94-cxp5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects admin-level access needed to plant payload; scope change (S:C) captures session impact on victim browsers with low C/I; no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.
This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored cross-site scripting in WatchGuard Fireware OS via the ConnectWise Technology Integration module allows a highly privileged attacker to inject persistent malicious scripts into the web management interface, which then execute in the browsers of other authenticated users who view the affected pages. This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2025-13937, indicating that the prior remediation was incomplete and a bypass exists. No public exploit code or CISA KEV listing has been identified at time of analysis, but the relationship to an earlier CVE suggests at least some organizational knowledge of the attack surface.
Technical ContextAI
WatchGuard Fireware OS is the operating system powering WatchGuard network security appliances (firewalls/UTM devices). The affected component is the ConnectWise Technology Integration module - a feature enabling managed service providers (MSPs) to integrate WatchGuard appliances with the ConnectWise RMM/PSA platform. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied input before it is rendered in the web UI, allowing script injection. Because it is stored rather than reflected, the payload persists in the application and executes for any subsequent user who views the affected page, not just the attacker. The CVSS 4.0 scope change metrics (SC:L/SI:L) confirm that impact crosses from the vulnerable system to a subsequent system - specifically, victim users' browser sessions.
RemediationAI
Consult WatchGuard PSIRT advisory WGSA-2026-00015 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00015 for the specific patched versions; the input data does not include an exact fix version number, so a vendor-released patched version is not independently confirmed at time of analysis. As a compensating control, organizations should disable or restrict access to the ConnectWise Technology Integration module if it is not actively required, since exploitation depends on this feature being configured. Restricting web management interface access to trusted administrator IP ranges via firewall policy reduces the exposure window for any session-hijacking impact. Audit existing admin accounts for signs of compromise given that a privileged account is required to plant the payload. Because this is a bypass of CVE-2025-13937's prior remediation, organizations that applied only the earlier patch should re-evaluate their exposure and apply the new update explicitly.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today