WatchGuard Fireware OS CVE-2026-13374

Exploitation requires three specific conditions to align: (1) The ConnectWise Technology Integration module must be configured and active within Fireware OS - this is a non-default, MSP-oriented integration, so standard deployments without ConnectWise are not affected. (2) The attacker must hold a high-privilege account on the Fireware OS web management interface (PR:H per CVSS 4.0), ruling out unauthenticated or low-privileged exploitation. (3) A second authenticated user (victim) must subsequently view the page where the payload was injected (UI:P). Limiting factors: the feature-gating on the ConnectWise module substantially narrows the exposed population; the high privilege requirement means this is not a mass-exploitation scenario but rather an insider threat, credential compromise, or chained-privilege escalation vector. The Fireware OS version must fall within the stated affected ranges (12.4-12.12, 12.5-12.5.18, or 2025.1-2026.2).

The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege barrier (PR:H) required to plant the payload and the passive user interaction (UI:P) needed to trigger it. Real-world risk is therefore constrained: exploitation requires an already-privileged account on the Fireware OS management interface, which limits the threat to insider scenarios, compromised admin credentials, or privilege escalation chains. EPSS data is not provided, and there is no CISA KEV listing, indicating no confirmed mass exploitation. However, the explicit framing as a bypass for CVE-2025-13937 is a material risk signal - it suggests the vendor attempted a prior fix that was insufficient, and organizations that applied the earlier patch may incorrectly believe they are protected. MSP environments using the ConnectWise integration represent a higher-value target given the blast radius of cross-customer access. The scope change in CVSS (impacting subsequent systems) means a successful attack can compromise sessions of other administrators, potentially enabling lateral movement beyond the initial access tier.

A threat actor who has obtained high-privileged administrative credentials to a WatchGuard Fireware OS management interface - through phishing, credential stuffing, or a prior compromise - navigates to the ConnectWise Technology Integration configuration panel and injects a malicious JavaScript payload into an input field that is stored and later rendered without sanitization. When another administrator or privileged user subsequently logs in and views the affected management page, the script executes in their browser, potentially stealing session tokens, redirecting authentication, or performing administrative actions on behalf of the victim.