Which versions of WatchGuard Fireware OS are affected by CVE-2026-1498?

WatchGuard Fireware OS versions 12.0-12.11.6, 12.5-12.5.15, and 2025.1-2026.0 contain an LDAP injection vulnerability that allows unauthenticated remote attackers to extract directory information…

How to fix or mitigate CVE-2026-1498?

Within 24 hours: audit your network inventory to confirm which WatchGuard Fireware OS instances run affected versions (12.0-12.11.6, 12.5-12.5.15, or 2025.1-2026.0); disable LDAP authentication on affected devices if operationally feasible, or restrict firewall management and authentication interface access to trusted administrative networks only. Within 7 days: open a support case with WatchGuard to request patch timeline and interim workarounds; enable detailed logging of LDAP directory queries to detect anomalous access patterns; implement network segmentation to limit LDAP directory exposure. Within 30 days: establish a weekly check of WatchGuard Security Center for patch notification; develop and stage an upgrade path to non-vulnerable versions once released; if no patch timeline is disclosed, evaluate alternative perimeter security products to reduce exposure risk.

WatchGuard Fireware OS CVE-2026-1498

Q: What is the CVSS score of CVE-2026-1498?

CVE-2026-1498 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

LDAP Injection (CWE-90)

2026-01-30 5d1c2695-1a31-4499-88ae-e847036fd7e3

Information Disclosure LDAP Code Injection Watchguard

7.0

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible and unauthenticated, but LDAP integration is a non-default prerequisite (AC:H); scope changes to the connected LDAP server (S:C) with high confidentiality and limited integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 20:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 20:22 NVD

7.0 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 13:15 nvd

N/A

DescriptionCVE.org

An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.This issue affects Fireware OS: from 12.0 through 12.11.6, from 12.5 through 12.5.15, from 2025.1 through 2026.0.

AnalysisAI

LDAP injection in WatchGuard Fireware OS allows remote unauthenticated attackers to query connected LDAP authentication servers for sensitive directory information via exposed web management or authentication interfaces, covering three separate version trains spanning 12.0-12.11.6, 12.5-12.5.15, and 2025.1-2026.0. A secondary condition permits partial-identifier authentication bypass when the attacker additionally possesses a valid target passphrase, extending the impact from information disclosure to unauthorized account access. No public exploit code has been identified and CISA has not listed this in KEV, but the unauthenticated network vector against a widely deployed perimeter security product warrants priority remediation in environments using LDAP-integrated authentication.

Technical ContextAI

CWE-90 (LDAP Injection) arises when user-supplied input is embedded into LDAP search filters or bind requests without proper escaping or metacharacter neutralization, allowing attackers to manipulate query logic by injecting characters such as wildcards, parentheses, or null bytes. In Fireware OS, the authentication or management web interface forwards login inputs to a configured external LDAP directory server without adequate sanitization, enabling two distinct attack paths: passive enumeration of LDAP object attributes (information disclosure) and a partial-identifier authentication bypass contingent on the attacker already possessing the target user's passphrase. The CVSS 4.0 vector's AT:P (Attack Prerequisites) metric formally encodes the requirement that LDAP integration must be actively configured - the WatchGuard device itself shows no direct impact (VC:N/VI:N/VA:N), while the connected LDAP infrastructure faces high confidentiality and integrity risk (SC:H/SI:H), reflecting the cross-system scope of the injection.

Affected ProductsAI

WatchGuard Fireware OS is affected across three distinct version ranges: 12.0 through 12.11.6, 12.5 through 12.5.15, and 2025.1 through 2026.0. No CPE strings were included in the available intelligence data. Administrators should consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00001 and https://psirt.watchguard.com/CVE-2026-1498 to confirm whether their installed version falls within an affected range and to identify the recommended remediation version.

RemediationAI

Administrators should consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00001 to identify the patched release and upgrade Fireware OS out of the affected ranges (12.0-12.11.6, 12.5-12.5.15, 2025.1-2026.0); no exact patched version number was present in the available intelligence data at time of analysis, so the specific target version must be confirmed directly from the vendor advisory before upgrading. As an immediate compensating control, restrict access to the authentication and management web interfaces using firewall ACLs or WatchGuard management access rules to permit only trusted administrative IP ranges, substantially reducing the network-facing attack surface without eliminating the underlying injection flaw. If LDAP authentication integration is not operationally required in a given deployment, disabling it removes the vulnerability entirely and is the most decisive interim measure. Organizations should also enable and review LDAP server access logs for anomalous search filter patterns as a detection measure during the remediation window.