WatchGuard Fireware OS EUVD-2026-111152

Exploitation requires network reachability to the WatchGuard Fireware OS management SSH interface; the attacker crafts a malicious request during the SSH authentication process to inject XPath. No credentials are needed (PR:N), no user interaction, and the description names no special non-default feature toggle - the required precondition is simply that the management SSH interface is reachable by the attacker. The principal limiting factor is therefore exposure of that management interface: deployments that restrict management SSH to a trusted/internal management network are not remotely exploitable from the internet, whereas appliances with the management SSH interface exposed to untrusted networks are directly at risk. Impact is confined to disclosure of sensitive configuration data; no integrity or availability impact is indicated.

This is a genuine priority but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the impact is scoped to confidentiality only (VC:H, with VI:N/VA:N), consistent with an information-disclosure flaw that leaks configuration data rather than granting code execution or data tampering. The vuln.today Decision label is 'this_week', indicating prompt but not emergency remediation. Key exploitation signals are MISSING: no EPSS probability was provided, the CVE is NOT on CISA KEV, and no public exploit code or PoC reference is listed, so there is no public exploit identified at time of analysis. The high base score (8.7) is driven by the unauthenticated network vector combined with high confidentiality impact, but the real-world exposure is materially limited because exploitation requires reachability of the management SSH interface - which on properly configured firewalls is not exposed to the untrusted internet. Treat as a high-priority patch for any deployment where the management SSH interface is externally or broadly reachable, and lower-priority where that interface is restricted to a trusted management network.

A remote attacker who can reach a Firebox's management SSH interface submits a specially crafted request during SSH authentication that injects malicious XPath syntax, causing the backend to return sensitive configuration data without any credentials. Because the attack is unauthenticated, low-complexity, and needs no user interaction, a single crafted connection to an exposed management port can disclose configuration secrets. No public exploit code or PoC reference is listed in the available data.