EUVD-2026-41451
GHSA-35hv-3mxg-g72p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible management UI with high privileges required for injection and required victim interaction triggering limited cross-scope browser impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored XSS in WatchGuard Fireware OS's spamBlocker module enables a high-privileged attacker to persist malicious JavaScript that executes in the browsers of other authenticated users viewing the affected management interface. This vulnerability is explicitly identified as an additional, unmitigated attack path bypassing the remediation applied for CVE-2025-1071, indicating the original fix was incomplete. The CVSS 4.0 vector scores this at 4.8 (Medium), with no confirmed active exploitation and no public exploit identified at time of analysis.
Technical ContextAI
The spamBlocker module within WatchGuard Fireware OS - the operating system powering WatchGuard network security appliances - fails to properly neutralize user-controlled input before persisting it to storage and later rendering it in the web-based management UI, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected CPE is cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*, covering a broad span of release trains: the 12.x branch (12.0 through 12.12, and 12.5 through 12.5.18) and the newer 2025.x/2026.x train (2025.1 through 2026.2). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms the vulnerability is reachable over the network with low complexity, but requires high privileges to inject, and passive user interaction for the payload to fire. The scope change (VC:N/VI:N/VA:N/SC:L/SI:L) indicates the vulnerable system itself is not directly degraded, but the subsequent system - the victim's browser session - suffers limited confidentiality and integrity impact, consistent with session-context theft or unauthorized UI actions.
RemediationAI
Consult WatchGuard's advisory WGSA-2026-00018 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00018 for the vendor-released patch - no specific fixed version number was included in the available intelligence, so the advisory should be treated as the authoritative source. As a compensating control, restrict access to the Fireware OS web management interface to trusted internal IP ranges only and avoid exposing the admin UI to untrusted networks; this limits the attack surface even if exploitation requires PR:H. Additionally, enforce multi-factor authentication on all administrative accounts to reduce the likelihood that high-privilege credentials are compromised and abused for injection. Given that this is a bypass of the CVE-2025-1071 fix, organizations should verify they have applied the latest available patch rather than assuming the prior remediation was sufficient.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially cra
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today