Which versions of WatchGuard Fireware OS are affected by CVE-2026-13383?

WatchGuard Fireware OS (Firebox appliances) is vulnerable to remote code execution via its management interface, requiring administrative credentials to exploit.

How to fix or mitigate CVE-2026-13383?

24 hours: Inventory all Firebox appliances and their firmware versions; restrict Management Web UI access to dedicated trusted networks or IP ranges via firewall rules; audit recent administrative access logs for anomalies. 7 days: Require multi-factor authentication for all administrative accounts; disable WAN-accessible remote management (port 8443) if operationally feasible; implement dedicated admin VLAN or bastion host architecture. 30 days: Contact WatchGuard for patch release timeline; implement enhanced logging of ikestubd process activity; evaluate additional network segmentation to isolate management traffic from user networks.

WatchGuard Fireware OS CVE-2026-13383

Q: What is the CVSS score of CVE-2026-13383?

CVE-2026-13383 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41453 HIGH

Out-of-bounds Write (CWE-787)

2026-07-02 WatchGuard

GHSA-x7ww-rpf2-73gx

RCE Buffer Overflow Memory Corruption Fireware Os Watchguard

8.6

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable Web UI with low complexity and no user interaction, but requires existing privileged admin access (PR:H); memory-corruption RCE yields full C/I/A impact on the appliance.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:52 vuln.today

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.This vulnerability affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Arbitrary code execution in WatchGuard Fireware OS (the firmware powering Firebox network security appliances) arises from an out-of-bounds write in the ikestubd process, reachable through the Management Web UI. An authenticated user holding privileged (administrative) access can send specially crafted requests to corrupt memory and execute code on the appliance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; risk is bounded by the requirement for existing privileged access.

Technical ContextAI

Fireware OS is WatchGuard's proprietary firewall operating system running on Firebox appliances. The vulnerable component, ikestubd, is associated with IKE (Internet Key Exchange) VPN/IPsec negotiation handling on the device; the flaw is triggered via the appliance's HTTPS Management Web UI rather than the raw IKE datagram path. The root cause is CWE-787 (Out-of-bounds Write): the process writes attacker-influenced data past the bounds of an allocated buffer, corrupting adjacent memory. Because ikestubd runs as a system-level service on the firewall, controlled memory corruption can be steered into control-flow hijack and native code execution on the security appliance itself.

RemediationAI

Patch available per vendor advisory (WatchGuard PSIRT WGSA-2026-00020, https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00020) - consult that advisory for the exact fixed Fireware OS release for your branch (12.x or 2025/2026 train) and upgrade, as no specific fixed version number was provided in the source data and version numbers should not be invented. As the primary compensating control until patched, restrict access to the Management Web UI: bind management to a trusted internal interface only, disable management access from the external/WAN interface, and place the management endpoint behind a management VLAN or jump host so it is not reachable from untrusted networks (trade-off: administrators must connect from the trusted segment or via VPN). Enforce strong, unique administrator credentials and multi-factor authentication for device administration and rotate any potentially exposed admin credentials, since exploitation requires privileged access; monitor management-plane logs for anomalous authenticated requests to the Web UI.