Which versions of Fireware Os are affected by CVE-2026-3987?

WatchGuard Fireware OS contains a critical remote code execution vulnerability affecting versions 12.6.1-12.11.8 and 2025.1-2026.1.2 that allows authenticated administrators to execute arbitrary code…

How to fix or mitigate CVE-2026-3987?

Within 24 hours: Inventory all WatchGuard Firewall OS deployments and identify systems running versions 12.6.1-12.11.8 or 2025.1-2026.1.2. Within 7 days: Implement strict administrative access controls-restrict Web UI admin accounts to trusted networks only, enforce MFA on administrative logins, and disable remote admin access unless operationally critical. Within 30 days: Monitor WatchGuard's official advisory for patch releases; consider upgrading to a patched version once available or evaluate alternative firewall solutions if patch availability remains indefinite.

Fireware Os CVE-2026-3987

Q: What is the CVSS score of CVE-2026-3987?

CVE-2026-3987 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-18090 HIGH

Path Traversal (CWE-22)

2026-04-01 WatchGuard

GHSA-8r96-cj5h-474x

RCE Path Traversal Fireware Os Watchguard

8.6

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (WatchGuard) · only source for this CVE.

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 22:16 euvd

EUVD-2026-18090

Analysis Generated

Apr 01, 2026 - 22:16 vuln.today

CVE Published

Apr 01, 2026 - 21:32 nvd

HIGH 8.6

DescriptionCVE.org

A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.This issue affects Fireware OS 12.6.1 up to and including 12.11.8 and 2025.1 up to and including 2026.1.2.

AnalysisAI

Remote code execution in WatchGuard Fireware OS versions 12.6.1 through 12.11.8 and 2025.1 through 2026.1.2 allows privileged authenticated attackers to execute arbitrary code with elevated system privileges via path traversal in the Web UI. The vulnerability requires high-level administrative access (CVSS PR:H) but presents a direct RCE path once authenticated. WatchGuard self-reported this issue with an official advisory available. EPSS and KEV data not provided; no public exploit identified at time of analysis.

Technical ContextAI

This is a CWE-22 path traversal vulnerability affecting the web-based management interface of WatchGuard Firebox firewall appliances running Fireware OS. Path traversal flaws occur when an application uses user-supplied input to construct file paths without proper sanitization, allowing attackers to navigate outside intended directories using sequences like '../'. In this case, the vulnerability exists in the Web UI component and enables code execution in an elevated system process context, suggesting the traversal allows access to executable paths or configuration files that trigger privileged operations. The affected CPE (cpe:2.3:a:watchguard:fireware_os) confirms this impacts the core operating system across multiple major version branches (12.x and 2025.x/2026.x), indicating a persistent design or implementation flaw in the Web UI's file handling across significant platform updates.

RemediationAI

Organizations should immediately consult WatchGuard's official security advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00009 for patch availability and specific upgrade instructions. Based on the affected version ranges, patched versions would logically be Fireware OS 12.11.9 or later for the 12.x branch and 2026.1.3 or later for the 2025/2026 branch, though exact fixed versions must be confirmed from the vendor advisory. Until patches can be applied, organizations should implement compensating controls including restricting Web UI access to trusted management networks only via firewall rules, enforcing multi-factor authentication for administrative accounts, monitoring administrative access logs for anomalous activity, and considering disabling remote Web UI access entirely if command-line management alternatives are viable. Regular review of administrative account credentials and implementation of least-privilege principles for firewall management can reduce exposure window.