Which versions of WatchGuard Fireware OS are affected by CVE-2026-13384?

WatchGuard Fireware (versions 12.1-12.12, 2025.1-2026.2) contains a vulnerability allowing authenticated users with administrative privileges to execute arbitrary code on the firewall appliance,…

How to fix or mitigate CVE-2026-13384?

Within 24 hours: Inventory all WatchGuard Fireware deployments and identify affected versions (12.1-12.12 and 2025.1-2026.2); implement network-level IP whitelisting to restrict Management Web UI access to trusted administrator networks only. Within 7 days: Conduct administrative account review and hardening (disable unused accounts, enforce strong passwords, implement account lockout policies); enable detailed audit logging for all Management Web UI sessions; review WatchGuard security bulletins for any interim mitigations. Within 30 days: Monitor WatchGuard and CISA advisories for patch availability; develop and test upgrade procedures to transition to patched versions once released; execute upgrades in scheduled maintenance windows.

WatchGuard Fireware OS CVE-2026-13384

Q: What is the CVSS score of CVE-2026-13384?

CVE-2026-13384 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41454 HIGH

Out-of-bounds Write (CWE-787)

2026-07-02 WatchGuard

GHSA-6xrf-cr85-wvqp

Memory Corruption Watchguard Buffer Overflow RCE Fireware Os

8.6

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable management UI with low complexity, but requires an authenticated privileged admin (PR:H); memory-corruption code execution yields full C/I/A impact on the appliance with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:52 vuln.today

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.This vulnerability affects Fireware OS 12.1 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Authenticated arbitrary code execution in WatchGuard Fireware OS (12.1-12.12 and 2025.1-2026.2) arises from an out-of-bounds write in the wgagent process, reachable when a privileged user sends specially crafted requests to the Management Web UI. A high-privilege attacker (or one who has compromised admin credentials) can corrupt memory to run code on the firewall appliance, undermining the security gateway itself. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Fireware OS is the firmware powering WatchGuard Firebox network security appliances, and wgagent is a backend process that services requests originating from the appliance's Management Web UI. The flaw is a CWE-787 Out-of-bounds Write (memory corruption): input from a crafted management request is written past the bounds of an allocated buffer, corrupting adjacent memory. On network appliances such conditions are frequently exploitable for control-flow hijack and code execution because the affected process typically runs with elevated privileges. The single CPE provided (cpe:2.3:a:watchguard:fireware_os) confirms the affected component is the Fireware OS application layer rather than a third-party library.

RemediationAI

Upgrade Fireware OS to the fixed release identified in WatchGuard PSIRT advisory WGSA-2026-00021 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00021); the input does not include a specific fixed version number, so treat patch status as available per vendor advisory and confirm the exact patched build for your branch (12.x versus 2025.1/2026.x) directly from that advisory before deploying. As compensating controls until patched, restrict access to the Management Web UI to a dedicated management network or trusted admin IP allowlist and disable management access on external/WAN interfaces (trade-off: remote administrators must use VPN or on-network access), enforce strong and unique administrator credentials with MFA to reduce the chance an attacker satisfies the PR:H requirement, and monitor management-interface logs for anomalous or malformed requests. Because exploitation requires an authenticated privileged account, tightening who holds Firebox admin credentials and rotating them materially reduces exposure.