EUVD-2026-41450
GHSA-cpgq-h7v8-r7qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires high privileges to inject (PR:H); stored XSS changes scope by executing in other admins' browsers (S:C), with low confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938.
This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored cross-site scripting in WatchGuard Fireware OS's Autotask Technology Integration module allows a high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other users who view the affected management interface pages. Affecting Fireware OS versions 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this flaw is explicitly described as an additional unmitigated attack path alongside the related CVE-2025-13938, suggesting prior remediation efforts were incomplete. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
WatchGuard Fireware OS (CPE: cpe:2.3:a:watchguard:fireware_os) is the proprietary operating system powering WatchGuard network security appliances, including their Firebox and XTM product lines. The vulnerability resides specifically in the Autotask Technology Integration module, which provides connectivity between the firewall management interface and the Autotask PSA (Professional Services Automation) platform used by managed service providers. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: input accepted via the Autotask module fields is stored server-side without adequate sanitization or output encoding, and is later rendered in the management web UI without neutralizing embedded script content. In stored XSS, the attacker's payload persists across sessions and fires for every subsequent user who loads the affected page, making it more impactful than reflected variants. The CVSS 4.0 vector's subsequent-system impact metrics (SC:L/SI:L) confirm the script executes in the context of a different user's browser session rather than the injecting administrator's own session.
RemediationAI
WatchGuard has published advisory WGSA-2026-00017 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00017, and a patch is available per vendor advisory; however, exact remediated version numbers are not enumerated in available intelligence and must be confirmed directly from that advisory before upgrade planning. As an interim compensating control, organizations should restrict administrative access to the Autotask Technology Integration module to the absolute minimum number of trusted accounts, audit existing Autotask integration configuration fields for any anomalous or unexpected script content, and review web server logs for unusual activity in the Autotask integration endpoints. For organizations not actively using the Autotask PSA integration, disabling or removing the Autotask module entirely is the most effective temporary mitigation - the trade-off being loss of PSA connectivity, which is acceptable for environments where this integration is unused. Enforcing strict Content Security Policy headers on the management interface (if configurable) can reduce XSS exploitability as a defense-in-depth measure. Given the relationship to CVE-2025-13938, organizations should verify whether patches for that prior CVE were fully applied before assuming coverage.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today