Watchguard
Monthly
The Kernel Memory Access Driver (PSKMAD) shipped with WatchGuard endpoint security products fails to enforce its access-control handshake, so a local authenticated user who can open a handle to the driver can issue arbitrary privileged commands and read kernel and process memory (CWE-306). The issue is strictly local (AV:L, PR:L, UI:N) and requires the attacker to already hold a working account on a managed endpoint where the driver is loaded, making it a privilege-escalation and memory-disclosure primitive rather than a remote entry path. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; scope is assessed as changed (S:C) because driver-level compromise extends beyond the caller's security context.
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management daemon, producing a denial of service on affected Firebox appliances. The root cause is a NULL pointer dereference (CWE-476) triggered by a specially crafted request to the login endpoint; impact is confined to availability of the management daemon, with no confidentiality or integrity loss and no code execution. Exploitation requires only network reachability to the management/authentication interface (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis (the CVE is not listed in CISA KEV). The published score of 8.7 reflects the CVSS 4.0 vector, while the independent assessment treats this as a genuine but bounded availability risk whose real-world severity hinges on how widely the login interface is exposed.
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the appliance by sending a specially crafted request to the login process known as wgagent. The affected code is part of the firewall's authentication/VPN interface, so any Firebox whose management or VPN portal is reachable from an untrusted network is exposed; exploitation is low-complexity and requires no credentials, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Impact is bounded to availability and there is no confidentiality or integrity loss and no code execution; no public exploit code was identified in the available intelligence and there is no CISA KEV confirmation of active exploitation at time of analysis.
Authenticated attackers with administrator privileges can exploit a stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS by sending a specially crafted management request, causing a service crash or potentially achieving arbitrary code execution. The vulnerability requires the spamBlocker feature to be licensed and enabled, and the management plane to be reachable; exploitation is therefore limited to insiders, stolen admin credentials, or post-compromise scenarios. No public exploit code has been identified at the time of analysis.
Improper authorization in WatchGuard Fireware OS's SAML login flow lets an authenticated SAML user who is scoped only to the Access Portal obtain unauthorized Mobile VPN with SSL access by submitting a specially crafted login request. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) confirms this is a bounded privilege-escalation issue: the attacker must already hold a valid low-privilege SAML account, SAML authentication must be configured, the Access Portal must be exposed, and Mobile VPN with SSL must be provisioned (PR:L, AT:P), with no user interaction required. No public exploit code and no CISA KEV entry were identified at time of analysis.
Arbitrary code execution in WatchGuard Fireware OS is possible through its SAML single sign-on session daemon (samld), which deserializes session files it is asked to load without adequately validating their contents. The attacker must already be authenticated with high privileges (CVSS 4.0 vector PR:H) and must already be able to write files on the appliance, since the vector's AT:P metric and the description both indicate a required prior condition - this is a second-stage, post-foothold vulnerability rather than a standalone remote compromise. Exploitation yields code execution in the security context of the samld service, with high confidentiality, integrity and availability impact to that service but no demonstrated impact on subsequent systems (SC:N/SI:N/SA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, allowing whoever controls the remote TLS VPN peer to push malicious configuration data that the connecting Firebox executes with root privileges, compromising the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 9.2, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is conditional rather than blanket internet-facing: the Firebox must be configured as a BOVPN Over TLS client and must actively initiate a session to an attacker-operated or attacker-compromised server, so a successful attack implies a malicious or hijacked peer relationship rather than an opportunistic scan-and-exploit against any Firebox. No credentials on the Firebox are required (PR:N) and no interactive user action is needed once the client connection is made; there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the confirmed root-level impact on a perimeter security device justifies treating this as a high-priority patch item.
Path traversal in the WatchGuard Fireware OS WebUI management agent lets an authenticated administrator read or list arbitrary files on the local filesystem by submitting a specially crafted management request. Exploitation requires valid WebUI administrator credentials (the highest management privilege on the Firebox), per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so the flaw is remote and low-complexity once the attacker already holds admin access, and the impact is limited to confidentiality (file read/list) with no write, code execution, or availability effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor advisory is published at https://psirt.watchguard.com/CVE-2026-13224 and no EPSS score was provided in the available data.
An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS can be triggered by a remote, unauthenticated attacker who has already completed the initial IKEv2 handshake, causing the iked process to crash and interrupting IPsec VPN service. Only Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable are exposed; the flaw is confined to availability (no confidentiality or integrity impact), and the practical blast radius is narrower than the 8.2 base score suggests because a valid IKEv2 session state must exist before the crafted encrypted message can be delivered. There is no public exploit identified at time of analysis, and no confirmed report of active exploitation. The vendor advisory is available at https://psirt.watchguard.com/CVE-2026-86133.
Authenticated low-privileged users - including read-only or guest administrator accounts - can crash the wgagent management daemon and read arbitrary files accessible to that daemon on WatchGuard Fireware OS by sending a specially crafted request to the management API's session initialization function, which is missing an authorization check. The attack is network-reachable and requires no user interaction, but it is gated behind a valid management-plane session at low privilege (PR:L), so exposure depends on how many such accounts exist and whether the management interface is reachable by the attacker. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the availability impact (high) dominates the limited confidentiality loss, giving this a genuine but access-gated priority.
Denial of service of the diagnostic-tools subsystem in WatchGuard Fireware OS can be triggered by a low-privileged, authenticated user who repeatedly starts and aborts a specially crafted diagnostic task through the management web UI. The authentication requirement (PR:L per the supplied vector) and the subsystem-confined blast radius, which does not reach the firewall's core traffic-processing functions, keep this a genuine but modest-priority issue rather than a device-wide outage; no public exploit code has been identified at time of analysis and no KEV listing is present in the intelligence. Note that the vendor's CVSS 4.0 score of 7.1 records high availability impact (VA:H) on the product, while our independent assessment scores availability as low (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because the resource exhaustion is limited to the diagnostic tooling.
Missing authorization in the wgagent management daemon of WatchGuard Fireware OS allows an authenticated, low-privileged management account - including read-only or guest administrator roles - to crash the daemon and read files accessible to its process by sending a crafted request to the management API. The weakness sits in the daemon's session-initialization function, which fails to enforce proper privilege validation before handling attacker-controlled input; the associated path-traversal class (CWE-22) is what enables the arbitrary file read, while the crash produces a denial-of-service condition against the agent. Exploitation requires a valid management session and network reachability to the management plane (CVSS 4.0: 7.1, PR:L, VA:H, VC:L), so risk concentrates on Fireboxes with exposed or broadly accessible management interfaces, multi-admin/multi-tenant deployments, and environments where guest or read-only admin accounts are provisioned. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Remote, unauthenticated denial of service in WatchGuard Fireware OS: an integer underflow (CWE-191) in the IKEv2 daemon (iked) is triggered when a remote attacker sends a specially crafted encrypted IKEv2 message within a session negotiated with an AES-GCM cipher suite, causing the daemon process to crash. Affected are Fireware OS deployments that terminate IPsec/IKEv2 VPNs on an interface reachable by the attacker - most commonly the WAN interface - and that offer or negotiate AES-GCM for IKEv2; deployments that do not use AES-GCM for IKEv2 are not on the vulnerable path. The attack requires no authentication and no user interaction, but impact is confined to availability (CVSS 4.0 VA:H with VC:N/VI:N and no subsequent-system impact), with no code execution or data disclosure; no public exploit code has been identified at time of analysis and the change is not reported as confirmed actively exploited (CISA KEV) in the available intelligence.
Denial of service in WatchGuard Fireware OS lets remote, unauthenticated attackers crash the appliance by delivering a specially crafted IPv6 packet into its NetFlow packet-processing path, triggering a NULL pointer dereference (CWE-476). The flaw is availability-only (vendor CVSS 4.0 base 8.2, with VA:H and no confidentiality or integrity impact) and requires that NetFlow processing is actually configured and reachable over IPv6, so exposure is limited to deployments that enable that feature rather than to every Firebox. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS signal was supplied; the practical risk is a repeatable remote crash of a perimeter device, which is still serious because a reboot or failover is required to restore service.
Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
OS command injection in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands on the affected access point by supplying crafted input to a diagnostic parameter. The vulnerability carries a CVSS v4.0 base score of 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and is independently assessed as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; exploitation requires valid administrator credentials for the AP's CLI (PR:H), but once authenticated no user interaction and only low attack complexity are needed, yielding high confidentiality, integrity, and availability impact on the device itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so realistic risk is concentrated where the AP management/CLI is network-reachable and administrative credentials are weak, reused, or exposed.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.
WatchGuard AuthPoint Gateway contains a missing authentication check in its LDAP Sync first-factor authentication that allows unauthenticated remote attackers to bypass single-factor password verification under non-default conditions. Exploitation requires the gateway to be configured with LDAP Sync as the first-factor method and involves some user interaction, but default deployments are unaffected; only the first factor is bypassed, so any additional MFA factors still apply and prevent full account compromise. No public exploit has been identified at time of analysis, and the vendor (WatchGuard PSIRT) rates this as CVSS 4.0 7.4 High with vector AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N.
Cross-site request forgery in WatchGuard Dimension's database snapshot creation endpoint allows a remote unauthenticated attacker to trigger unauthorized snapshot operations by luring an authenticated Dimension administrator to visit a malicious web page. The primary risk is availability degradation: repeated forced snapshot creation can exhaust storage or impose significant I/O load on the Dimension appliance (VA:H per CVSS 4.0). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command execution on the host system. An authenticated user holding report administration permissions can send specially crafted requests to the log viewer endpoint, injecting SQL that ultimately invokes OS-level commands running as the Dimension WebUI process account. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability class is well-understood and the vendor itself reported it, indicating confirmed existence.
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hijack a Super Administrator account by harvesting that user's session token from a diagnostic log in the web UI. Because session identifiers are written unredacted, any authenticated administrator who can read the diagnostic log can impersonate a Super Administrator while that user is logged in, gaining full control of the management platform. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding it with TCP SYN packets, a classic resource exhaustion denial-of-service technique. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication, no user interaction, and no configuration prerequisite required. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS command execution, running as the Dimension WebUI process account. The vulnerability is exploitable by any user holding report administration permissions, making it a significant lateral-movement and post-compromise pivot risk within WatchGuard-managed network environments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the chained SQL injection-to-command-execution primitive is high impact for attackers who have obtained admin-level credentials.
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic. The flaw (CWE-191) resides in the IKEv1/IKEv2 key exchange handler, meaning any internet-exposed WatchGuard appliance with VPN enabled is reachable from the network perimeter without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack vector and availability impact of 8.7 (CVSS 4.0) make this a meaningful risk for organizations relying on WatchGuard VPN for remote access continuity.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.
Remote code execution in the WatchGuard Agent allows an unauthenticated attacker with network access to trigger arbitrary code execution at elevated privilege due to an improper authentication flaw (CWE-306). The CVSS 4.0 base score of 9.3 reflects a network-reachable, no-interaction, no-privilege attack yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth reachability and privileged code execution makes this a high-priority exposure.
Remote code execution in WatchGuard Agent lets an unauthenticated attacker positioned on an adjacent network chain a missing-authentication weakness (CWE-306) with path traversal into arbitrary code execution on the host. Rated CVSS 4.0 9.4 (Critical) by WatchGuard, the flaw combines an authentication bypass with directory traversal so no credentials or user interaction are required. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, no-auth, high-impact profile makes it a high-priority patch item.
Authenticated command execution in WatchGuard Fireware OS lets a privileged administrator escalate a specially crafted CLI command into arbitrary code execution via an out-of-bounds write (CWE-787). The flaw affects a very broad version span (Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2), placing most currently and historically deployed WatchGuard Firebox appliances in scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 score of 8.6 reflects full confidentiality/integrity/availability impact once the required privileged access is obtained.
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allows an authenticated privileged administrator to run arbitrary code on the firewall by sending specially crafted requests to the Management Web UI, which trigger an out-of-bounds write in the networkd process. The flaw spans a wide version range (11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2) and carries a CVSS 4.0 base score of 8.6 (High). It was reported by WatchGuard's own PSIRT; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in the WatchGuard Fireware OS Management Web UI lets a privileged, authenticated administrator escape the intended directory and write files anywhere on a Firebox appliance's filesystem, per CVSS 4.0 (AV:N/PR:H). This affects Fireware OS across the 11.x, 12.x, and 2025.1-2026.2 branches and can be leveraged to tamper with configuration or system binaries, potentially leading to code execution or device compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in WatchGuard Mobile VPN with SSL client for Windows (versions up to and including 2026.2) lets an authenticated local attacker elevate from a low-privileged account to NT AUTHORITY\SYSTEM on any machine where the client is installed. The flaw is rooted in insecure permission assignment (CWE-732), and there is no public exploit identified at time of analysis, though the vendor-reported nature and full high-impact CVSS (7.3, CVSS 4.0) make it a meaningful endpoint-hardening concern.
Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, unauthenticated, high-impact profile makes it a serious perimeter-device concern.
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sending specially crafted IKEv2 messages that trigger a null pointer dereference (CWE-476). The flaw affects appliances running Mobile User VPN with IKEv2 or Branch Office VPN over IKEv2 with a dynamic gateway peer, spanning Fireware OS 11.10.2 through 2026.2. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss.
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticates against an external LDAP server. A race condition in the IKEv2 LDAP authentication path can be driven into a use-after-free (CWE-416) inside the iked daemon, letting a remote unauthenticated attacker execute arbitrary code in the context of that process. No public exploit identified at time of analysis, and the CVSS 4.0 base score of 9.2 is tempered by high attack complexity and a probabilistic attack requirement (AC:H/AT:P), reflecting the difficulty of reliably winning the race.
Firmware signature validation bypass in WatchGuard Fireware OS lets an authenticated administrator upload a tampered firmware image through the backup/restore feature and have it installed despite failing integrity checks. Affecting Fireware OS branches 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2025.6.2, the flaw (CWE-347) enables persistent malicious code on the appliance. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high integrity/confidentiality/availability impact and the appliance's privileged network position make it significant.
Authenticated arbitrary code execution in WatchGuard Fireware OS (12.1-12.12 and 2025.1-2026.2) arises from an out-of-bounds write in the wgagent process, reachable when a privileged user sends specially crafted requests to the Management Web UI. A high-privilege attacker (or one who has compromised admin credentials) can corrupt memory to run code on the firewall appliance, undermining the security gateway itself. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in WatchGuard Fireware OS (the firmware powering Firebox network security appliances) arises from an out-of-bounds write in the ikestubd process, reachable through the Management Web UI. An authenticated user holding privileged (administrative) access can send specially crafted requests to corrupt memory and execute code on the appliance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; risk is bounded by the requirement for existing privileged access.
Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with elevated system privileges through DLL hijacking. The agent searches for dependencies in user-controllable directories, enabling attackers with standard user credentials to plant malicious DLLs that load when the service starts. WatchGuard has released version 1.25.03.0000 to address this uncontrolled search path vulnerability (CWE-427).
Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious code into existing agent processes, achieving high-impact confidentiality, integrity, and availability compromise. WatchGuard Agent versions prior to 1.25.03.0000 are affected. CVSS v4.0 score of 8.5 reflects local attack vector with low complexity and low privilege requirements, though no active exploitation (KEV) or public POC has been identified at time of analysis. The vulnerability's CWE-321 classification indicates embedded cryptographic material that could be extracted and reused for process injection attacks.
Privilege escalation in WatchGuard Agent for Windows allows authenticated local users to gain NT AUTHORITY\SYSTEM privileges via incorrect permissions in the patch management component. CVSS 7.3 with low attack complexity and local attack vector. No active exploitation or public exploit code identified at time of analysis. EPSS data not available - real-world risk depends on defender endpoint deployment environments where local user access is already established.
Stack-based buffer overflow in WatchGuard Agent discovery service on Windows enables adjacent attackers without authentication to crash the agent via crafted network packets. CVSS 7.1 (High) reflects adjacent network attack vector with high integrity impact. The vulnerability targets the discovery service component used for agent enrollment and network communication. No CISA KEV listing or public exploit code identified at time of analysis, though the local network attack vector limits exposure to adjacent attackers.
Stack-based buffer overflow in WatchGuard Agent's discovery service allows adjacent network attackers to crash the agent service without authentication. Affects Windows installations prior to version 1.25.03.0000. Vendor patch released addressing the vulnerability. SSVC framework indicates no active exploitation observed and manual exploitation required. While CVSS 7.1 (High) reflects network-adjacent access with high availability impact, actual risk is limited to denial-of-service - no code execution or data compromise possible per the CVSS vector (VC:N/VI:N/VA:H).
Remote code execution in WatchGuard Fireware OS versions 12.6.1 through 12.11.8 and 2025.1 through 2026.1.2 allows privileged authenticated attackers to execute arbitrary code with elevated system privileges via path traversal in the Web UI. The vulnerability requires high-level administrative access (CVSS PR:H) but presents a direct RCE path once authenticated. WatchGuard self-reported this issue with an official advisory available. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in WatchGuard Fireware OS WebUI allows remote attackers to trigger a denial-of-service condition against the Web UI by tricking an authenticated administrator into visiting a malicious webpage. This affects Fireware OS versions 11.8 through 11.12.4+541730, 12.0 through 12.11.8, and 2025.1 through 2026.1.2. The CVSS v4.0 score of 7.1 reflects high availability impact (VA:H) with no user authentication required (PR:N) but requiring user interaction (UI:P). No public exploit identified at time of analysis, though the attack complexity is low and the CSRF nature makes weaponization straightforward for adversaries targeting firewall administrators.
Insecure deserialization in WatchGuard Fireware OS enables local code execution as the portald user when combined with a filesystem write primitive. Affects Fireware OS versions 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on platforms supporting Access Portal (excludes T-15/T-35 models). CVSS 8.4 severity reflects high impact but requires prior high-privilege local access and an existing write vulnerability to exploit. No public exploit identified at time of analysis, with EPSS data unavailable for risk probability assessment.
WatchGuard Fireware OS contains an out-of-bounds write vulnerability in its management interface that permits authenticated administrators to achieve root-level code execution. The flaw affects versions 11.9 through 11.12.4_Update1, 12.0 through 12.11.7, and 2025.1 through 2026.1.1, with no patch currently available. While exploitation requires high-level administrative privileges, successful attacks grant complete system compromise.
LDAP injection in WatchGuard Fireware OS allows remote unauthenticated attackers to query connected LDAP authentication servers for sensitive directory information via exposed web management or authentication interfaces, covering three separate version trains spanning 12.0-12.11.6, 12.5-12.5.15, and 2025.1-2026.0. A secondary condition permits partial-identifier authentication bypass when the attacker additionally possesses a valid target passphrase, extending the impact from information disclosure to unauthorized account access. No public exploit code has been identified and CISA has not listed this in KEV, but the unauthenticated network vector against a widely deployed perimeter security product warrants priority remediation in environments using LDAP-integrated authentication.
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an unauthenticated remote attacker run arbitrary code on Firebox appliances that use IKEv2 for mobile user VPN or for a branch office VPN with a dynamic gateway peer. Notably, appliances remain exposed even after those configurations are removed if any IKEv2 branch office VPN to a static gateway peer is still configured, widening the vulnerable population beyond current dynamic-peer setups. The CISA KEV catalog reference indicates confirmed active exploitation, and the CVSS 4.0 base score of 9.3 reflects unauthenticated network-facing RCE.
WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execution on WatchGuard firewalls.
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.5%.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored XSS in WatchGuard Dimension's Trusted CA certificate configuration enables an authenticated administrator to inject persistent JavaScript that executes in the browser of other authenticated administrators. The attack requires high-privilege access to the management console to plant the payload and passive interaction from a victim administrator to trigger it, constraining the threat to insider abuse or compromised admin accounts. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the limited, intra-admin scope.
Server-side request forgery in WatchGuard Dimension's Email Server Test configuration feature enables authenticated privileged attackers to probe and enumerate network services on adjacent network segments. The vulnerability stems from insufficient validation of server-initiated outbound requests, allowing the Dimension management platform to be weaponized as a network scanning proxy. No public exploit code has been identified at time of analysis, and the attack requires high-privilege credentials, materially limiting realistic exposure.
Stored cross-site scripting in WatchGuard Dimension's Backup Historical Data feature permits an authenticated administrator to inject arbitrary JavaScript that executes in the browser context of other users who view the affected data. The CVSS 4.0 vector (PR:H, SC:L/SI:L) confirms the attacker must hold admin credentials and that impact is confined to subsequent systems - other users' browser sessions - with no direct impact on the Dimension host itself. No public exploit code and no CISA KEV listing exist at time of analysis.
WatchGuard Dimension exposes a server-side configuration endpoint that fails to enforce the client-side lock/unlock workflow state, allowing any authenticated read-write administrator to submit configuration changes directly to the API without completing the UI unlock step. This creates a race condition where a privileged user can silently overwrite changes being made by a second concurrent administrator session. No public exploit exists and exploitation requires valid administrator credentials, but the flaw undermines the integrity of multi-administrator change management workflows in Dimension deployments.
Reflected XSS in WatchGuard Dimension's report detail page allows arbitrary JavaScript execution in the browser of an authenticated victim when they follow a specially crafted URL. The vulnerability requires social engineering an already-authenticated Dimension user - likely an administrator, given the CVSS 4.0 PR:H rating - into clicking an attacker-controlled link, constraining the attack to targeted phishing scenarios against active sessions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the source intelligence.
Server-side request forgery in WatchGuard Dimension's Remote Backup Connection Test configuration feature allows authenticated privileged users to enumerate exposed network services on adjacent systems. The CVSS 4.0 score of 5.3 reflects confined impact - no direct compromise of the Dimension host itself, but meaningful secondary-system reconnaissance capability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
WatchGuard Dimension's web login endpoint permits unlimited automated password guessing against user accounts because rate-limiting and account lockout are both absent in the default product configuration. All versions of Dimension (CPE wildcard, no version boundary) are affected in default-configured deployments. An unauthenticated remote attacker can systematically guess credentials and gain unauthorized account access; the CWE-203 classification further indicates the endpoint may expose observable discrepancies that enable username enumeration, reducing the effort required for targeted credential attacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Stored XSS in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject persistent JavaScript into scheduling fields, which silently executes in the browser session of any other user who subsequently views the affected interface. Unlike reflected XSS, the stored nature of this vulnerability means a single injection can compromise multiple sessions without further attacker interaction, including those of higher-privileged administrators. No public exploit code or active exploitation has been identified at the time of analysis.
Server-side request forgery in WatchGuard Dimension's FTP Server Test configuration feature allows a privileged authenticated attacker to probe and enumerate network services on adjacent network systems. The vulnerability affects all tracked versions of WatchGuard Dimension (CPE wildcard) and is limited to subsequent-system confidentiality impact - specifically service discovery on internal or adjacent hosts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
WatchGuard Dimension, the network security visibility and management platform, contains a business logic flaw (CWE-284) that permits an authenticated administrator to trigger multiple backend operations within a single logical request flow by sending a specially crafted HTTP request. All versions of Dimension are listed as affected via the wildcard CPE, and the impact is high confidentiality exposure on the Dimension system itself with limited subsequent-system effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the PR:H requirement constrains exploitation to actors who already hold or have compromised administrator credentials.
Blind server-side request forgery in WatchGuard Dimension's Database Server Test configuration feature allows an authenticated privileged attacker to enumerate network services on adjacent systems by exploiting observable timing or response discrepancies (CWE-208). The scope of impact extends beyond the Dimension host itself to adjacent network segments, enabling internal network reconnaissance without direct access to those systems. No public exploit is identified at time of analysis, and the high privilege requirement substantially limits the realistic attacker pool.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
WatchGuard Fireware OS deployed in FireCluster high-availability configurations falls back to a static, hard-coded encryption key to protect saved Access Portal credentials under unspecified exception circumstances, meaning any actor who can retrieve those encrypted credential stores can decrypt them offline using the known firmware key. Affected builds span Fireware OS 12.1 through 12.12 and 2025.1 through 2026.2; standalone Fireboxes and devices without Access Portal support are explicitly out of scope. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but CWE-798 class flaws become broadly exploitable once the static key is extracted from firmware through reverse engineering.
Stored XSS in WatchGuard Fireware OS's SIP Proxy module enables a high-privileged attacker to plant persistent malicious JavaScript that executes in the browsers of other privileged users who access affected management interface pages. Covering Fireware OS versions 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this CVE is explicitly disclosed as an additional, previously unmitigated attack path for CVE-2025-6947 - meaning organizations that applied the prior patch may incorrectly believe their exposure is closed. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Stored XSS in WatchGuard Fireware OS's spamBlocker module enables a high-privileged attacker to persist malicious JavaScript that executes in the browsers of other authenticated users viewing the affected management interface. This vulnerability is explicitly identified as an additional, unmitigated attack path bypassing the remediation applied for CVE-2025-1071, indicating the original fix was incomplete. The CVSS 4.0 vector scores this at 4.8 (Medium), with no confirmed active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in WatchGuard Fireware OS's Autotask Technology Integration module allows a high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other users who view the affected management interface pages. Affecting Fireware OS versions 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this flaw is explicitly described as an additional unmitigated attack path alongside the related CVE-2025-13938, suggesting prior remediation efforts were incomplete. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in WatchGuard Fireware OS via the ConnectWise Technology Integration module allows a highly privileged attacker to inject persistent malicious scripts into the web management interface, which then execute in the browsers of other authenticated users who view the affected pages. This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2025-13937, indicating that the prior remediation was incomplete and a bypass exists. No public exploit code or CISA KEV listing has been identified at time of analysis, but the relationship to an earlier CVE suggests at least some organizational knowledge of the attack surface.
Stored XSS in WatchGuard Fireware OS's Tigerpaw Technology Integration module allows a high-privileged attacker to persist malicious scripts within the management interface, which then execute in the browsers of other authenticated users who visit the affected pages. Critically, this CVE is identified as an additional unmitigated attack path for CVE-2025-13936, indicating an incomplete remediation of a prior related XSS flaw in the same integration module. Affected versions span the 12.4, 12.5, and 2025.x/2026.x release trains; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in WatchGuard Fireware OS Management Web UI allows an authenticated administrator to crash the management service by submitting crafted input to the put_data endpoint, which performs unsafe deserialization of attacker-controlled data (CWE-502). The CVSS 4.0 vector (PR:H, VA:H) confirms that exploitation is restricted to administrator-level accounts and results in availability loss only - no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the insider-threat and compromised-credential risk category.
WatchGuard Fireware OS contains a filesystem integrity bypass vulnerability in versions 12.0-12.11.7, 12.5.9-12.5.16, and 2025.1-2026.1.1 that allows authenticated attackers with high privileges to deploy malicious firmware updates and establish limited persistence on affected appliances. An attacker could circumvent security checks designed to validate firmware authenticity, though currently no patch is available.
Fireware OS Web UI contains a reflected XSS vulnerability that allows attackers to execute arbitrary JavaScript in authenticated administrators' browsers through crafted links, affecting versions 12.7-12.11.7 and 2025.1-2026.1.1. An attacker can leverage this to perform administrative actions or steal session credentials from targeted management users who click malicious links. No patch is currently available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.
The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.
Stack-based buffer overflow in WatchGuard Fireware OS enables authenticated privileged users to execute arbitrary code by sending specially crafted CLI commands to the certificate request functionality. Affected versions span two distinct branches: 12.0 through 12.5.12+701324 and 12.6 through 12.11.2. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS of 0.04% (13th percentile) signals very low observed exploitation activity, though the high-privilege requirement significantly constrains the realistic threat population.
XPath Injection in WatchGuard Fireware OS exposes sensitive Firebox configuration data to remote unauthenticated attackers via the authentication or management web interface. Affected systems span four major version branches from 11.11 through 2025.1.2, covering a wide range of deployed Firebox hardware appliances. Exploitation is conditioned on the authentication hotspot feature being enabled; no public exploit code exists and EPSS sits at 0.11% (30th percentile), indicating low observed exploitation activity despite the high CVSS 4.0 score of 8.2.
The Kernel Memory Access Driver (PSKMAD) shipped with WatchGuard endpoint security products fails to enforce its access-control handshake, so a local authenticated user who can open a handle to the driver can issue arbitrary privileged commands and read kernel and process memory (CWE-306). The issue is strictly local (AV:L, PR:L, UI:N) and requires the attacker to already hold a working account on a managed endpoint where the driver is loaded, making it a privilege-escalation and memory-disclosure primitive rather than a remote entry path. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; scope is assessed as changed (S:C) because driver-level compromise extends beyond the caller's security context.
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management daemon, producing a denial of service on affected Firebox appliances. The root cause is a NULL pointer dereference (CWE-476) triggered by a specially crafted request to the login endpoint; impact is confined to availability of the management daemon, with no confidentiality or integrity loss and no code execution. Exploitation requires only network reachability to the management/authentication interface (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis (the CVE is not listed in CISA KEV). The published score of 8.7 reflects the CVSS 4.0 vector, while the independent assessment treats this as a genuine but bounded availability risk whose real-world severity hinges on how widely the login interface is exposed.
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the appliance by sending a specially crafted request to the login process known as wgagent. The affected code is part of the firewall's authentication/VPN interface, so any Firebox whose management or VPN portal is reachable from an untrusted network is exposed; exploitation is low-complexity and requires no credentials, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Impact is bounded to availability and there is no confidentiality or integrity loss and no code execution; no public exploit code was identified in the available intelligence and there is no CISA KEV confirmation of active exploitation at time of analysis.
Authenticated attackers with administrator privileges can exploit a stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS by sending a specially crafted management request, causing a service crash or potentially achieving arbitrary code execution. The vulnerability requires the spamBlocker feature to be licensed and enabled, and the management plane to be reachable; exploitation is therefore limited to insiders, stolen admin credentials, or post-compromise scenarios. No public exploit code has been identified at the time of analysis.
Improper authorization in WatchGuard Fireware OS's SAML login flow lets an authenticated SAML user who is scoped only to the Access Portal obtain unauthorized Mobile VPN with SSL access by submitting a specially crafted login request. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) confirms this is a bounded privilege-escalation issue: the attacker must already hold a valid low-privilege SAML account, SAML authentication must be configured, the Access Portal must be exposed, and Mobile VPN with SSL must be provisioned (PR:L, AT:P), with no user interaction required. No public exploit code and no CISA KEV entry were identified at time of analysis.
Arbitrary code execution in WatchGuard Fireware OS is possible through its SAML single sign-on session daemon (samld), which deserializes session files it is asked to load without adequately validating their contents. The attacker must already be authenticated with high privileges (CVSS 4.0 vector PR:H) and must already be able to write files on the appliance, since the vector's AT:P metric and the description both indicate a required prior condition - this is a second-stage, post-foothold vulnerability rather than a standalone remote compromise. Exploitation yields code execution in the security context of the samld service, with high confidentiality, integrity and availability impact to that service but no demonstrated impact on subsequent systems (SC:N/SI:N/SA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, allowing whoever controls the remote TLS VPN peer to push malicious configuration data that the connecting Firebox executes with root privileges, compromising the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 9.2, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exposure is conditional rather than blanket internet-facing: the Firebox must be configured as a BOVPN Over TLS client and must actively initiate a session to an attacker-operated or attacker-compromised server, so a successful attack implies a malicious or hijacked peer relationship rather than an opportunistic scan-and-exploit against any Firebox. No credentials on the Firebox are required (PR:N) and no interactive user action is needed once the client connection is made; there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the confirmed root-level impact on a perimeter security device justifies treating this as a high-priority patch item.
Path traversal in the WatchGuard Fireware OS WebUI management agent lets an authenticated administrator read or list arbitrary files on the local filesystem by submitting a specially crafted management request. Exploitation requires valid WebUI administrator credentials (the highest management privilege on the Firebox), per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so the flaw is remote and low-complexity once the attacker already holds admin access, and the impact is limited to confidentiality (file read/list) with no write, code execution, or availability effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor advisory is published at https://psirt.watchguard.com/CVE-2026-13224 and no EPSS score was provided in the available data.
An integer underflow in the IKE daemon (iked) of WatchGuard Fireware OS can be triggered by a remote, unauthenticated attacker who has already completed the initial IKEv2 handshake, causing the iked process to crash and interrupting IPsec VPN service. Only Firebox appliances running Fireware OS with IKEv2 IPsec VPN enabled and reachable are exposed; the flaw is confined to availability (no confidentiality or integrity impact), and the practical blast radius is narrower than the 8.2 base score suggests because a valid IKEv2 session state must exist before the crafted encrypted message can be delivered. There is no public exploit identified at time of analysis, and no confirmed report of active exploitation. The vendor advisory is available at https://psirt.watchguard.com/CVE-2026-86133.
Authenticated low-privileged users - including read-only or guest administrator accounts - can crash the wgagent management daemon and read arbitrary files accessible to that daemon on WatchGuard Fireware OS by sending a specially crafted request to the management API's session initialization function, which is missing an authorization check. The attack is network-reachable and requires no user interaction, but it is gated behind a valid management-plane session at low privilege (PR:L), so exposure depends on how many such accounts exist and whether the management interface is reachable by the attacker. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the availability impact (high) dominates the limited confidentiality loss, giving this a genuine but access-gated priority.
Denial of service of the diagnostic-tools subsystem in WatchGuard Fireware OS can be triggered by a low-privileged, authenticated user who repeatedly starts and aborts a specially crafted diagnostic task through the management web UI. The authentication requirement (PR:L per the supplied vector) and the subsystem-confined blast radius, which does not reach the firewall's core traffic-processing functions, keep this a genuine but modest-priority issue rather than a device-wide outage; no public exploit code has been identified at time of analysis and no KEV listing is present in the intelligence. Note that the vendor's CVSS 4.0 score of 7.1 records high availability impact (VA:H) on the product, while our independent assessment scores availability as low (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because the resource exhaustion is limited to the diagnostic tooling.
Missing authorization in the wgagent management daemon of WatchGuard Fireware OS allows an authenticated, low-privileged management account - including read-only or guest administrator roles - to crash the daemon and read files accessible to its process by sending a crafted request to the management API. The weakness sits in the daemon's session-initialization function, which fails to enforce proper privilege validation before handling attacker-controlled input; the associated path-traversal class (CWE-22) is what enables the arbitrary file read, while the crash produces a denial-of-service condition against the agent. Exploitation requires a valid management session and network reachability to the management plane (CVSS 4.0: 7.1, PR:L, VA:H, VC:L), so risk concentrates on Fireboxes with exposed or broadly accessible management interfaces, multi-admin/multi-tenant deployments, and environments where guest or read-only admin accounts are provisioned. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Remote, unauthenticated denial of service in WatchGuard Fireware OS: an integer underflow (CWE-191) in the IKEv2 daemon (iked) is triggered when a remote attacker sends a specially crafted encrypted IKEv2 message within a session negotiated with an AES-GCM cipher suite, causing the daemon process to crash. Affected are Fireware OS deployments that terminate IPsec/IKEv2 VPNs on an interface reachable by the attacker - most commonly the WAN interface - and that offer or negotiate AES-GCM for IKEv2; deployments that do not use AES-GCM for IKEv2 are not on the vulnerable path. The attack requires no authentication and no user interaction, but impact is confined to availability (CVSS 4.0 VA:H with VC:N/VI:N and no subsequent-system impact), with no code execution or data disclosure; no public exploit code has been identified at time of analysis and the change is not reported as confirmed actively exploited (CISA KEV) in the available intelligence.
Denial of service in WatchGuard Fireware OS lets remote, unauthenticated attackers crash the appliance by delivering a specially crafted IPv6 packet into its NetFlow packet-processing path, triggering a NULL pointer dereference (CWE-476). The flaw is availability-only (vendor CVSS 4.0 base 8.2, with VA:H and no confidentiality or integrity impact) and requires that NetFlow processing is actually configured and reachable over IPv6, so exposure is limited to deployments that enable that feature rather than to every Firebox. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS signal was supplied; the practical risk is a repeatable remote crash of a perimeter device, which is still serious because a reboot or failover is required to restore service.
Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
OS command injection in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands on the affected access point by supplying crafted input to a diagnostic parameter. The vulnerability carries a CVSS v4.0 base score of 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and is independently assessed as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; exploitation requires valid administrator credentials for the AP's CLI (PR:H), but once authenticated no user interaction and only low attack complexity are needed, yielding high confidentiality, integrity, and availability impact on the device itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so realistic risk is concentrated where the AP management/CLI is network-reachable and administrative credentials are weak, reused, or exposed.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.
WatchGuard AuthPoint Gateway contains a missing authentication check in its LDAP Sync first-factor authentication that allows unauthenticated remote attackers to bypass single-factor password verification under non-default conditions. Exploitation requires the gateway to be configured with LDAP Sync as the first-factor method and involves some user interaction, but default deployments are unaffected; only the first factor is bypassed, so any additional MFA factors still apply and prevent full account compromise. No public exploit has been identified at time of analysis, and the vendor (WatchGuard PSIRT) rates this as CVSS 4.0 7.4 High with vector AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N.
Cross-site request forgery in WatchGuard Dimension's database snapshot creation endpoint allows a remote unauthenticated attacker to trigger unauthorized snapshot operations by luring an authenticated Dimension administrator to visit a malicious web page. The primary risk is availability degradation: repeated forced snapshot creation can exhaust storage or impose significant I/O load on the Dimension appliance (VA:H per CVSS 4.0). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command execution on the host system. An authenticated user holding report administration permissions can send specially crafted requests to the log viewer endpoint, injecting SQL that ultimately invokes OS-level commands running as the Dimension WebUI process account. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability class is well-understood and the vendor itself reported it, indicating confirmed existence.
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hijack a Super Administrator account by harvesting that user's session token from a diagnostic log in the web UI. Because session identifiers are written unredacted, any authenticated administrator who can read the diagnostic log can impersonate a Super Administrator while that user is logged in, gaining full control of the management platform. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding it with TCP SYN packets, a classic resource exhaustion denial-of-service technique. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication, no user interaction, and no configuration prerequisite required. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS command execution, running as the Dimension WebUI process account. The vulnerability is exploitable by any user holding report administration permissions, making it a significant lateral-movement and post-compromise pivot risk within WatchGuard-managed network environments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the chained SQL injection-to-command-execution primitive is high impact for attackers who have obtained admin-level credentials.
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN session negotiation. By sending specially crafted network packets to the IKE service, an attacker can trigger an integer underflow in iked, crashing VPN processing and disrupting all VPN-dependent connectivity without any authentication. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic. The flaw (CWE-191) resides in the IKEv1/IKEv2 key exchange handler, meaning any internet-exposed WatchGuard appliance with VPN enabled is reachable from the network perimeter without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack vector and availability impact of 8.7 (CVSS 4.0) make this a meaningful risk for organizations relying on WatchGuard VPN for remote access continuity.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially crafted IKE network traffic that triggers a double-free memory corruption in the iked daemon. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms zero prerequisites for exploitation against any internet-exposed WatchGuard appliance with IPsec VPN active. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.
Remote code execution in the WatchGuard Agent allows an unauthenticated attacker with network access to trigger arbitrary code execution at elevated privilege due to an improper authentication flaw (CWE-306). The CVSS 4.0 base score of 9.3 reflects a network-reachable, no-interaction, no-privilege attack yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth reachability and privileged code execution makes this a high-priority exposure.
Remote code execution in WatchGuard Agent lets an unauthenticated attacker positioned on an adjacent network chain a missing-authentication weakness (CWE-306) with path traversal into arbitrary code execution on the host. Rated CVSS 4.0 9.4 (Critical) by WatchGuard, the flaw combines an authentication bypass with directory traversal so no credentials or user interaction are required. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, no-auth, high-impact profile makes it a high-priority patch item.
Authenticated command execution in WatchGuard Fireware OS lets a privileged administrator escalate a specially crafted CLI command into arbitrary code execution via an out-of-bounds write (CWE-787). The flaw affects a very broad version span (Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2), placing most currently and historically deployed WatchGuard Firebox appliances in scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 score of 8.6 reflects full confidentiality/integrity/availability impact once the required privileged access is obtained.
Remote code execution in WatchGuard Fireware OS (the operating system powering Firebox network security appliances) allows an authenticated privileged administrator to run arbitrary code on the firewall by sending specially crafted requests to the Management Web UI, which trigger an out-of-bounds write in the networkd process. The flaw spans a wide version range (11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2) and carries a CVSS 4.0 base score of 8.6 (High). It was reported by WatchGuard's own PSIRT; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in the WatchGuard Fireware OS Management Web UI lets a privileged, authenticated administrator escape the intended directory and write files anywhere on a Firebox appliance's filesystem, per CVSS 4.0 (AV:N/PR:H). This affects Fireware OS across the 11.x, 12.x, and 2025.1-2026.2 branches and can be leveraged to tamper with configuration or system binaries, potentially leading to code execution or device compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in WatchGuard Mobile VPN with SSL client for Windows (versions up to and including 2026.2) lets an authenticated local attacker elevate from a low-privileged account to NT AUTHORITY\SYSTEM on any machine where the client is installed. The flaw is rooted in insecure permission assignment (CWE-732), and there is no public exploit identified at time of analysis, though the vendor-reported nature and full high-impact CVSS (7.3, CVSS 4.0) make it a meaningful endpoint-hardening concern.
Remote code execution in WatchGuard Fireware OS (the firmware powering WatchGuard Firebox firewall appliances) allows an unauthenticated attacker positioned on the same local/adjacent network segment to trigger an out-of-bounds write and execute arbitrary code. The flaw spans a wide firmware range - 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2 - and was self-reported by WatchGuard via its PSIRT. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, unauthenticated, high-impact profile makes it a serious perimeter-device concern.
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sending specially crafted IKEv2 messages that trigger a null pointer dereference (CWE-476). The flaw affects appliances running Mobile User VPN with IKEv2 or Branch Office VPN over IKEv2 with a dynamic gateway peer, spanning Fireware OS 11.10.2 through 2026.2. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss.
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticates against an external LDAP server. A race condition in the IKEv2 LDAP authentication path can be driven into a use-after-free (CWE-416) inside the iked daemon, letting a remote unauthenticated attacker execute arbitrary code in the context of that process. No public exploit identified at time of analysis, and the CVSS 4.0 base score of 9.2 is tempered by high attack complexity and a probabilistic attack requirement (AC:H/AT:P), reflecting the difficulty of reliably winning the race.
Firmware signature validation bypass in WatchGuard Fireware OS lets an authenticated administrator upload a tampered firmware image through the backup/restore feature and have it installed despite failing integrity checks. Affecting Fireware OS branches 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2025.6.2, the flaw (CWE-347) enables persistent malicious code on the appliance. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high integrity/confidentiality/availability impact and the appliance's privileged network position make it significant.
Authenticated arbitrary code execution in WatchGuard Fireware OS (12.1-12.12 and 2025.1-2026.2) arises from an out-of-bounds write in the wgagent process, reachable when a privileged user sends specially crafted requests to the Management Web UI. A high-privilege attacker (or one who has compromised admin credentials) can corrupt memory to run code on the firewall appliance, undermining the security gateway itself. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in WatchGuard Fireware OS (the firmware powering Firebox network security appliances) arises from an out-of-bounds write in the ikestubd process, reachable through the Management Web UI. An authenticated user holding privileged (administrative) access can send specially crafted requests to corrupt memory and execute code on the appliance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; risk is bounded by the requirement for existing privileged access.
Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with elevated system privileges through DLL hijacking. The agent searches for dependencies in user-controllable directories, enabling attackers with standard user credentials to plant malicious DLLs that load when the service starts. WatchGuard has released version 1.25.03.0000 to address this uncontrolled search path vulnerability (CWE-427).
Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious code into existing agent processes, achieving high-impact confidentiality, integrity, and availability compromise. WatchGuard Agent versions prior to 1.25.03.0000 are affected. CVSS v4.0 score of 8.5 reflects local attack vector with low complexity and low privilege requirements, though no active exploitation (KEV) or public POC has been identified at time of analysis. The vulnerability's CWE-321 classification indicates embedded cryptographic material that could be extracted and reused for process injection attacks.
Privilege escalation in WatchGuard Agent for Windows allows authenticated local users to gain NT AUTHORITY\SYSTEM privileges via incorrect permissions in the patch management component. CVSS 7.3 with low attack complexity and local attack vector. No active exploitation or public exploit code identified at time of analysis. EPSS data not available - real-world risk depends on defender endpoint deployment environments where local user access is already established.
Stack-based buffer overflow in WatchGuard Agent discovery service on Windows enables adjacent attackers without authentication to crash the agent via crafted network packets. CVSS 7.1 (High) reflects adjacent network attack vector with high integrity impact. The vulnerability targets the discovery service component used for agent enrollment and network communication. No CISA KEV listing or public exploit code identified at time of analysis, though the local network attack vector limits exposure to adjacent attackers.
Stack-based buffer overflow in WatchGuard Agent's discovery service allows adjacent network attackers to crash the agent service without authentication. Affects Windows installations prior to version 1.25.03.0000. Vendor patch released addressing the vulnerability. SSVC framework indicates no active exploitation observed and manual exploitation required. While CVSS 7.1 (High) reflects network-adjacent access with high availability impact, actual risk is limited to denial-of-service - no code execution or data compromise possible per the CVSS vector (VC:N/VI:N/VA:H).
Remote code execution in WatchGuard Fireware OS versions 12.6.1 through 12.11.8 and 2025.1 through 2026.1.2 allows privileged authenticated attackers to execute arbitrary code with elevated system privileges via path traversal in the Web UI. The vulnerability requires high-level administrative access (CVSS PR:H) but presents a direct RCE path once authenticated. WatchGuard self-reported this issue with an official advisory available. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in WatchGuard Fireware OS WebUI allows remote attackers to trigger a denial-of-service condition against the Web UI by tricking an authenticated administrator into visiting a malicious webpage. This affects Fireware OS versions 11.8 through 11.12.4+541730, 12.0 through 12.11.8, and 2025.1 through 2026.1.2. The CVSS v4.0 score of 7.1 reflects high availability impact (VA:H) with no user authentication required (PR:N) but requiring user interaction (UI:P). No public exploit identified at time of analysis, though the attack complexity is low and the CSRF nature makes weaponization straightforward for adversaries targeting firewall administrators.
Insecure deserialization in WatchGuard Fireware OS enables local code execution as the portald user when combined with a filesystem write primitive. Affects Fireware OS versions 12.1 through 12.11.8 and 2025.1 through 2026.1.2 on platforms supporting Access Portal (excludes T-15/T-35 models). CVSS 8.4 severity reflects high impact but requires prior high-privilege local access and an existing write vulnerability to exploit. No public exploit identified at time of analysis, with EPSS data unavailable for risk probability assessment.
WatchGuard Fireware OS contains an out-of-bounds write vulnerability in its management interface that permits authenticated administrators to achieve root-level code execution. The flaw affects versions 11.9 through 11.12.4_Update1, 12.0 through 12.11.7, and 2025.1 through 2026.1.1, with no patch currently available. While exploitation requires high-level administrative privileges, successful attacks grant complete system compromise.
LDAP injection in WatchGuard Fireware OS allows remote unauthenticated attackers to query connected LDAP authentication servers for sensitive directory information via exposed web management or authentication interfaces, covering three separate version trains spanning 12.0-12.11.6, 12.5-12.5.15, and 2025.1-2026.0. A secondary condition permits partial-identifier authentication bypass when the attacker additionally possesses a valid target passphrase, extending the impact from information disclosure to unauthorized account access. No public exploit code has been identified and CISA has not listed this in KEV, but the unauthenticated network vector against a widely deployed perimeter security product warrants priority remediation in environments using LDAP-integrated authentication.
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an unauthenticated remote attacker run arbitrary code on Firebox appliances that use IKEv2 for mobile user VPN or for a branch office VPN with a dynamic gateway peer. Notably, appliances remain exposed even after those configurations are removed if any IKEv2 branch office VPN to a static gateway peer is still configured, widening the vulnerable population beyond current dynamic-peer setups. The CISA KEV catalog reference indicates confirmed active exploitation, and the CVSS 4.0 base score of 9.3 reflects unauthenticated network-facing RCE.
WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execution on WatchGuard firewalls.
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.5%.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored XSS in WatchGuard Dimension's Trusted CA certificate configuration enables an authenticated administrator to inject persistent JavaScript that executes in the browser of other authenticated administrators. The attack requires high-privilege access to the management console to plant the payload and passive interaction from a victim administrator to trigger it, constraining the threat to insider abuse or compromised admin accounts. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the limited, intra-admin scope.
Server-side request forgery in WatchGuard Dimension's Email Server Test configuration feature enables authenticated privileged attackers to probe and enumerate network services on adjacent network segments. The vulnerability stems from insufficient validation of server-initiated outbound requests, allowing the Dimension management platform to be weaponized as a network scanning proxy. No public exploit code has been identified at time of analysis, and the attack requires high-privilege credentials, materially limiting realistic exposure.
Stored cross-site scripting in WatchGuard Dimension's Backup Historical Data feature permits an authenticated administrator to inject arbitrary JavaScript that executes in the browser context of other users who view the affected data. The CVSS 4.0 vector (PR:H, SC:L/SI:L) confirms the attacker must hold admin credentials and that impact is confined to subsequent systems - other users' browser sessions - with no direct impact on the Dimension host itself. No public exploit code and no CISA KEV listing exist at time of analysis.
WatchGuard Dimension exposes a server-side configuration endpoint that fails to enforce the client-side lock/unlock workflow state, allowing any authenticated read-write administrator to submit configuration changes directly to the API without completing the UI unlock step. This creates a race condition where a privileged user can silently overwrite changes being made by a second concurrent administrator session. No public exploit exists and exploitation requires valid administrator credentials, but the flaw undermines the integrity of multi-administrator change management workflows in Dimension deployments.
Reflected XSS in WatchGuard Dimension's report detail page allows arbitrary JavaScript execution in the browser of an authenticated victim when they follow a specially crafted URL. The vulnerability requires social engineering an already-authenticated Dimension user - likely an administrator, given the CVSS 4.0 PR:H rating - into clicking an attacker-controlled link, constraining the attack to targeted phishing scenarios against active sessions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the source intelligence.
Server-side request forgery in WatchGuard Dimension's Remote Backup Connection Test configuration feature allows authenticated privileged users to enumerate exposed network services on adjacent systems. The CVSS 4.0 score of 5.3 reflects confined impact - no direct compromise of the Dimension host itself, but meaningful secondary-system reconnaissance capability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
WatchGuard Dimension's web login endpoint permits unlimited automated password guessing against user accounts because rate-limiting and account lockout are both absent in the default product configuration. All versions of Dimension (CPE wildcard, no version boundary) are affected in default-configured deployments. An unauthenticated remote attacker can systematically guess credentials and gain unauthorized account access; the CWE-203 classification further indicates the endpoint may expose observable discrepancies that enable username enumeration, reducing the effort required for targeted credential attacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Stored XSS in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject persistent JavaScript into scheduling fields, which silently executes in the browser session of any other user who subsequently views the affected interface. Unlike reflected XSS, the stored nature of this vulnerability means a single injection can compromise multiple sessions without further attacker interaction, including those of higher-privileged administrators. No public exploit code or active exploitation has been identified at the time of analysis.
Server-side request forgery in WatchGuard Dimension's FTP Server Test configuration feature allows a privileged authenticated attacker to probe and enumerate network services on adjacent network systems. The vulnerability affects all tracked versions of WatchGuard Dimension (CPE wildcard) and is limited to subsequent-system confidentiality impact - specifically service discovery on internal or adjacent hosts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
WatchGuard Dimension, the network security visibility and management platform, contains a business logic flaw (CWE-284) that permits an authenticated administrator to trigger multiple backend operations within a single logical request flow by sending a specially crafted HTTP request. All versions of Dimension are listed as affected via the wildcard CPE, and the impact is high confidentiality exposure on the Dimension system itself with limited subsequent-system effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the PR:H requirement constrains exploitation to actors who already hold or have compromised administrator credentials.
Blind server-side request forgery in WatchGuard Dimension's Database Server Test configuration feature allows an authenticated privileged attacker to enumerate network services on adjacent systems by exploiting observable timing or response discrepancies (CWE-208). The scope of impact extends beyond the Dimension host itself to adjacent network segments, enabling internal network reconnaissance without direct access to those systems. No public exploit is identified at time of analysis, and the high privilege requirement substantially limits the realistic attacker pool.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
WatchGuard Fireware OS deployed in FireCluster high-availability configurations falls back to a static, hard-coded encryption key to protect saved Access Portal credentials under unspecified exception circumstances, meaning any actor who can retrieve those encrypted credential stores can decrypt them offline using the known firmware key. Affected builds span Fireware OS 12.1 through 12.12 and 2025.1 through 2026.2; standalone Fireboxes and devices without Access Portal support are explicitly out of scope. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but CWE-798 class flaws become broadly exploitable once the static key is extracted from firmware through reverse engineering.
Stored XSS in WatchGuard Fireware OS's SIP Proxy module enables a high-privileged attacker to plant persistent malicious JavaScript that executes in the browsers of other privileged users who access affected management interface pages. Covering Fireware OS versions 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this CVE is explicitly disclosed as an additional, previously unmitigated attack path for CVE-2025-6947 - meaning organizations that applied the prior patch may incorrectly believe their exposure is closed. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Stored XSS in WatchGuard Fireware OS's spamBlocker module enables a high-privileged attacker to persist malicious JavaScript that executes in the browsers of other authenticated users viewing the affected management interface. This vulnerability is explicitly identified as an additional, unmitigated attack path bypassing the remediation applied for CVE-2025-1071, indicating the original fix was incomplete. The CVSS 4.0 vector scores this at 4.8 (Medium), with no confirmed active exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in WatchGuard Fireware OS's Autotask Technology Integration module allows a high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other users who view the affected management interface pages. Affecting Fireware OS versions 12.4 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this flaw is explicitly described as an additional unmitigated attack path alongside the related CVE-2025-13938, suggesting prior remediation efforts were incomplete. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in WatchGuard Fireware OS via the ConnectWise Technology Integration module allows a highly privileged attacker to inject persistent malicious scripts into the web management interface, which then execute in the browsers of other authenticated users who view the affected pages. This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2025-13937, indicating that the prior remediation was incomplete and a bypass exists. No public exploit code or CISA KEV listing has been identified at time of analysis, but the relationship to an earlier CVE suggests at least some organizational knowledge of the attack surface.
Stored XSS in WatchGuard Fireware OS's Tigerpaw Technology Integration module allows a high-privileged attacker to persist malicious scripts within the management interface, which then execute in the browsers of other authenticated users who visit the affected pages. Critically, this CVE is identified as an additional unmitigated attack path for CVE-2025-13936, indicating an incomplete remediation of a prior related XSS flaw in the same integration module. Affected versions span the 12.4, 12.5, and 2025.x/2026.x release trains; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in WatchGuard Fireware OS Management Web UI allows an authenticated administrator to crash the management service by submitting crafted input to the put_data endpoint, which performs unsafe deserialization of attacker-controlled data (CWE-502). The CVSS 4.0 vector (PR:H, VA:H) confirms that exploitation is restricted to administrator-level accounts and results in availability loss only - no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the insider-threat and compromised-credential risk category.
WatchGuard Fireware OS contains a filesystem integrity bypass vulnerability in versions 12.0-12.11.7, 12.5.9-12.5.16, and 2025.1-2026.1.1 that allows authenticated attackers with high privileges to deploy malicious firmware updates and establish limited persistence on affected appliances. An attacker could circumvent security checks designed to validate firmware authenticity, though currently no patch is available.
Fireware OS Web UI contains a reflected XSS vulnerability that allows attackers to execute arbitrary JavaScript in authenticated administrators' browsers through crafted links, affecting versions 12.7-12.11.7 and 2025.1-2026.1.1. An attacker can leverage this to perform administrative actions or steal session credentials from targeted management users who click malicious links. No patch is currently available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.
The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.
Stack-based buffer overflow in WatchGuard Fireware OS enables authenticated privileged users to execute arbitrary code by sending specially crafted CLI commands to the certificate request functionality. Affected versions span two distinct branches: 12.0 through 12.5.12+701324 and 12.6 through 12.11.2. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS of 0.04% (13th percentile) signals very low observed exploitation activity, though the high-privilege requirement significantly constrains the realistic threat population.
XPath Injection in WatchGuard Fireware OS exposes sensitive Firebox configuration data to remote unauthenticated attackers via the authentication or management web interface. Affected systems span four major version branches from 11.11 through 2025.1.2, covering a wide range of deployed Firebox hardware appliances. Exploitation is conditioned on the authentication hotspot feature being enabled; no public exploit code exists and EPSS sits at 0.11% (30th percentile), indicating low observed exploitation activity despite the high CVSS 4.0 score of 8.2.