Watchguard Fireware OS vulnerabilities, page 3
74 vulnerabilities
Known vulnerabilities in Watchguard Fireware OS, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-13371watchguard · fireware +1 moreWatchGuard Firebox Management Web UI Denial of Service via Unsafe DeserializationAn authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.EPSS0.59%MediumCVE-2026-13375watchguard · fireware +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration ConfigurationImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938.
This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.EPSS0.27%HighCVE-2026-86132watchguard · fireware +1 moreFireware OS Pre-Authentication Integer Underflow in iked Allows Denial of ServiceAn integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.EPSS0.36%HighCVE-2026-86134watchguard · fireware +1 moreFireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of ServiceA NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.EPSS0.38%HighCVE-2026-86105watchguard · fireware +1 moreFireware OS Improper Authorization in Access Portal Reverse ProxyAn improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.EPSS0.31%HighCVE-2026-86104watchguard · fireware +1 moreFireware OS Resource Exhaustion in Login Process Allows Denial of ServiceAn uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.EPSS0.36%HighCVE-2026-86128watchguard · fireware +1 moreFireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of ServiceA NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.EPSS0.36%HighCVE-2026-86133watchguard · fireware +1 moreFireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of ServiceAn integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.EPSS0.35%CriticalCVE-2026-86131watchguard · fireware +1 moreFireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code ExecutionA code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.EPSS0.42%HighCVE-2026-86101watchguard · fireware +1 moreFireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN AccessAn improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.EPSS0.22%HighCVE-2026-86136watchguard · fireware +1 moreFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant AA missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.EPSS0.30%HighCVE-2026-1498watchguard · fireware osWatchGuard Firebox LDAP InjectionAn LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.EPSS0.93%CriticalCVE-2026-19313watchguard · fireware osFireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code ExecutionAn heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.EPSS0.47%HighCVE-2026-19314watchguard · fireware osFireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.EPSS0.32%CriticalCVE-2026-19318watchguard · fireware osFireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code ExecutionA stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.EPSS0.47%CriticalCVE-2026-19315watchguard · fireware osFireware OS Pre-Authentication Type Confusion in iked Allows Remote Code ExecutionA type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.EPSS0.46%HighCVE-2026-19317watchguard · fireware osFireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.EPSS0.32%HighCVE-2026-19316watchguard · fireware osFireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.EPSS0.32%HighCVE-2026-4315watchguard · fireware +1 moreWatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UIA Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.EPSS0.24%HighCVE-2026-4266watchguard · fireware +1 moreWatchGuard Firebox Insecure Deserialization in Fireware Access PortalAn Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user.
Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.EPSS0.39%