Which versions of WatchGuard Fireware OS are affected by EUVD-2026-41461?

WatchGuard Fireware OS (versions 11.x, 12.x, and 2025.1-2026.2) contains a critical file-write vulnerability in the management web UI that allows authenticated administrators to write arbitrary files…

How to fix or mitigate EUVD-2026-41461?

Within 24 hours: identify all Firebox appliances and document running Fireware versions against the affected ranges (11.x, 12.x, 2025.1-2026.2). Within 7 days: implement principle of least privilege for administrative accounts; enforce multi-factor authentication on admin portal access; enable and centralize administrative action logging for detection of file-write operations. Within 30 days: monitor WatchGuard security advisories for patch releases and plan firmware upgrade windows; evaluate network segmentation to isolate Firebox management interfaces.

WatchGuard Fireware OS EUVD-2026-41461

Q: What is the CVSS score of EUVD-2026-41461?

EUVD-2026-41461 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-13054 HIGH

Path Traversal (CWE-22)

2026-07-02 WatchGuard

GHSA-7hv2-pqx4-78v6

Path Traversal Fireware Os Watchguard

8.6

CVSS 4.0 · Vendor: WatchGuard

Severity by source

Vendor (WatchGuard) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable management UI (AV:N/AC:L) but requires an authenticated privileged admin (PR:H); arbitrary file write on the OS yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WatchGuard).

CVSS VectorVendor: WatchGuard

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:54 vuln.today

DescriptionCVE.org

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

AnalysisAI

Arbitrary file write in the WatchGuard Fireware OS Management Web UI lets a privileged, authenticated administrator escape the intended directory and write files anywhere on a Firebox appliance's filesystem, per CVSS 4.0 (AV:N/PR:H). This affects Fireware OS across the 11.x, 12.x, and 2025.1-2026.2 branches and can be leveraged to tamper with configuration or system binaries, potentially leading to code execution or device compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Fireware OS is the embedded network operating system that powers WatchGuard Firebox firewall and UTM appliances, and its browser-based Management Web UI is the primary administrative interface for configuring the device. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): a file-writing operation in the Web UI fails to properly sanitize path input, so sequences such as '../' allow the intended write location to be escaped and an attacker-controlled path to be reached elsewhere on the appliance filesystem. The single CPE (cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*) confirms Fireware OS itself as the affected component rather than a specific hardware model, meaning any Firebox running an affected firmware branch is in scope.

RemediationAI

Upgrade Fireware OS to the fixed release identified in WatchGuard PSIRT advisory WGSA-2026-00028 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00028); an exact patched version string was not included in the provided data, so treat this as a patch available per vendor advisory and verify the specific target build for your 11.x, 12.x, or 2025.1/2026.x branch before upgrading. Because exploitation requires privileged authenticated access (PR:H), the highest-value compensating controls are to restrict the Management Web UI to a dedicated management network or trusted admin IPs and never expose it to the internet, enforce strong unique credentials plus multi-factor authentication on all administrator accounts, and audit the current administrator roster to remove stale or over-privileged accounts. These access restrictions have minimal functional side effects beyond requiring admins to connect from approved locations, and they directly shrink the population of accounts able to reach the vulnerable endpoint until the firmware update is applied.