EUVD-2026-41450
GHSA-cpgq-h7v8-r7qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires high privileges to inject (PR:H); stored XSS changes scope by executing in other admins' browsers (S:C), with low confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938.
This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored cross-site scripting in WatchGuard Fireware OS's Autotask Technology Integration module allows a high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other users who view the affected management interface pages. Affecting Fireware OS versions 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this flaw is explicitly described as an additional unmitigated attack path alongside the related CVE-2025-13938, suggesting prior remediation efforts were incomplete. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
WatchGuard Fireware OS (CPE: cpe:2.3:a:watchguard:fireware_os) is the proprietary operating system powering WatchGuard network security appliances, including their Firebox and XTM product lines. The vulnerability resides specifically in the Autotask Technology Integration module, which provides connectivity between the firewall management interface and the Autotask PSA (Professional Services Automation) platform used by managed service providers. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: input accepted via the Autotask module fields is stored server-side without adequate sanitization or output encoding, and is later rendered in the management web UI without neutralizing embedded script content. In stored XSS, the attacker's payload persists across sessions and fires for every subsequent user who loads the affected page, making it more impactful than reflected variants. The CVSS 4.0 vector's subsequent-system impact metrics (SC:L/SI:L) confirm the script executes in the context of a different user's browser session rather than the injecting administrator's own session.
RemediationAI
WatchGuard has published advisory WGSA-2026-00017 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00017, and a patch is available per vendor advisory; however, exact remediated version numbers are not enumerated in available intelligence and must be confirmed directly from that advisory before upgrade planning. As an interim compensating control, organizations should restrict administrative access to the Autotask Technology Integration module to the absolute minimum number of trusted accounts, audit existing Autotask integration configuration fields for any anomalous or unexpected script content, and review web server logs for unusual activity in the Autotask integration endpoints. For organizations not actively using the Autotask PSA integration, disabling or removing the Autotask module entirely is the most effective temporary mitigation - the trade-off being loss of PSA connectivity, which is acceptable for environments where this integration is unused. Enforcing strict Content Security Policy headers on the management interface (if configurable) can reduce XSS exploitability as a defense-in-depth measure. Given the relationship to CVE-2025-13938, organizations should verify whether patches for that prior CVE were fully applied before assuming coverage.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially cra
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today