WatchGuard Fireware OS
91 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-90465 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation | CRITICAL 9.4 | |||
| CVE-2026-93862 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service | HIGH 7.2 | |||
| CVE-2026-93434 | 12.0 – < 12.5.22 | Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets | HIGH 8.7 | |||
| CVE-2026-90464 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | HIGH 7.2 | |||
| CVE-2026-90442 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service | HIGH 8.6 | |||
| CVE-2026-113881 | 2025.1 – < 2026.4 ; 12.9 – < 12.12.4 | Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution | MEDIUM 6.1 | |||
| CVE-2026-112710 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-112709 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-103593 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution | CRITICAL 9.1 | |||
| CVE-2026-93866 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write | CRITICAL 9.2 | |||
| CVE-2026-93865 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection | CRITICAL 9.2 | |||
| CVE-2026-93864 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root | HIGH 7.1 | |||
| CVE-2026-93857 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution | CRITICAL 9.2 | |||
| CVE-2026-82332 | 2025.1 – < 2026.4 ; 12.7 – < 12.12.4 | Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking | MEDIUM 5.7 | |||
| CVE-2026-111107 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service | HIGH 8.7 | |||
| CVE-2026-104381 | 2025.1 – < 2026.4 ; 12.0 – < 12.12.4 | Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service | MEDIUM 6.0 | |||
| CVE-2026-103594 | 2026.2 – < 2026.4 ; 12.12 – < 12.12.4 | Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution | CRITICAL 9.5 | |||
| CVE-2026-86134 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service | HIGH 8.7 | 0.4 % | ||
| CVE-2026-86104 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Resource Exhaustion in Login Process Allows Denial of Service | HIGH 8.7 | 0.4 % | ||
| CVE-2026-90441 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B | HIGH 7.1 | 0.2 % | ||
| CVE-2026-86136 | 2026.0 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A | HIGH 7.1 | 0.3 % | ||
| CVE-2026-86133 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service | HIGH 8.2 | 0.3 % | ||
| CVE-2026-86132 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service | HIGH 8.2 | 0.4 % | ||
| CVE-2026-86131 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-86128 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service | HIGH 8.2 | 0.4 % | ||
| CVE-2026-86105 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Improper Authorization in Access Portal Reverse Proxy | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-86101 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access | HIGH 7.2 | 0.2 % | ||
| CVE-2026-81433 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution | HIGH 8.7 | 0.2 % | ||
| CVE-2026-18145 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution | HIGH 8.6 | 0.4 % | ||
| CVE-2026-18105 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service | HIGH 7.1 | 0.2 % | ||
| CVE-2026-13224 | 12.0 – < 12.5.21 | Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read | HIGH 8.2 | 0.4 % | ||
| CVE-2026-13046 | 2026.3 – < 2026.3.2 ; 2025.0 – < 2026.2.3 ; 12.0 – < 12.12.3 | Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78011 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-19317 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-19315 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-19314 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-78010 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2026-78009 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-78008 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Authenticated Buffer Overflow in wgagent | HIGH 8.6 | 0.6 % | ||
| CVE-2026-19318 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 | Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-19316 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-19313 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 | Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-13086 | 2025.0 – < 2026.2.2 ; 12.0 – < 12.12.2 ; 2026.3 – < 2026.3.1 | Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-81851 | 2025.0 – < 2026.2.1 ; 12.0 – < 12.12.1 | Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-13053 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; ≥ 11.0 | WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Command Handler | HIGH 8.6 | 0.6 % | ||
| CVE-2026-13050 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; ≥ 11.8 | WatchGuard Firebox networkd Out of Bounds Write Vulnerability | HIGH 8.6 | 0.6 % | ||
| CVE-2026-13054 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; ≥ 11.0 | WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI | HIGH 8.6 | 0.6 % | ||
| CVE-2026-8247 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; ≥ 11.0 | WatchGuard Firebox admd Out of Bounds Write Vulnerability | HIGH 7.7 | 0.4 % | ||
| CVE-2026-13728 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 | WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-13084 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; ≥ 11.10.2 | Null Pointer Dereference in WatchGuard Fireware OS iked Process | HIGH 8.7 | 0.6 % | ||
| CVE-2026-13368 | 2025.1 – < 2026.2.1 | WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication | CRITICAL 9.2 | 0.9 % | ||
| CVE-2026-13722 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 ; 11.0 – 11.12.4+541730 | WatchGuard Firebox Firmware Image Validation Bypass in WatchGuard Fireware OS | HIGH 8.6 | 0.3 % | ||
| CVE-2026-13384 | 2025.1 – < 2026.2.1 ; 12.1 – < 12.12.1 | WatchGuard Firebox wgagent Out of Bounds Write Vulnerability | HIGH 8.6 | 0.7 % | ||
| CVE-2026-13383 | 2025.1 – < 2026.2.1 ; 12.1 – < 12.12.1 | WatchGuard Firebox ikestubd Out of Bounds Write Vulnerability | HIGH 8.6 | 0.7 % | ||
| CVE-2026-13377 | 12.0 – < 12.11.9 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-13376 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-13375 | 2025.1 – < 2026.2.1 ; 12.4 – < 12.12.1 ; 2025.1 – 2026.2 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-13374 | 2025.1 – < 2026.2.1 ; 12.4 – < 12.12.1 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-13373 | 2025.1 – < 2026.2.1 ; 12.4 – < 12.12.1 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-13371 | 2025.1 – < 2026.2.1 ; 12.0 – < 12.12.1 | WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-3987 | 2025.1 – < 2026.2 ; 12.6.1 – < 12.12 | WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI | HIGH 8.6 | 0.7 % | ||
| CVE-2026-4315 | 2025.1 – < 2026.2 ; 12.0 – < 12.12 ; 11.8 – 11.12.4+541730 | WatchGuard Firebox Cross-Site Request Forgery (CSRF) in Fireware Web UI | HIGH 7.1 | 0.2 % | ||
| CVE-2026-4266 | 2025.1 – < 2026.2 ; 12.1 – < 12.12 | WatchGuard Firebox Insecure Deserialization in Fireware Access Portal | HIGH 8.4 | 0.3 % | ||
| CVE-2026-3344 | 2025.1 – < 2026.1.2 ; 12.0 – < 12.11.8 | WatchGuard Firebox System Integrity Check Bypass | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-3343 | 2025.1 – < 2026.1.2 ; 12.7 – < 12.11.8 | WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-3342 | 11.9 – 11.12.4+541730 ; 12.0 – 12.11.7 ; 12.5 – 12.5.16 ; … | WatchGuard Firebox Out of Bounds Write Vulnerability | HIGH 8.6 | 6.7 % | ||
| CVE-2026-1498 | 2025.1 – < 2026.1 ; 12.0 – < 12.11.7 | WatchGuard Firebox LDAP Injection | HIGH 7.0 | 0.9 % | ||
| CVE-2025-14733 | 2025.1 – < 2025.1.4 ; 12.0 – < 12.11.6 ; 11.10.2 – 11.12.4+541730 | WatchGuard Firebox iked Out of Bounds Write Vulnerability | CRITICAL 9.3 | 29 % | KEV | |
| CVE-2025-1547 | 12.0 – 12.11.3 | WatchGuard Firebox Authenticated Stack Overflow in Certificate Request Command | HIGH 7.5 | 0.4 % | ||
| CVE-2025-6946 | 12.0 – < 12.11.3 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in IPS Configuration | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-1545 | 2025.1 – < 2025.1.3 ; 12.0 – < 12.11.5 ; 11.11 – 11.12.4+541730 | WatchGuard Firebox XPath Injection Vulnerability in Web CGI | HIGH 8.2 | 0.5 % | ||
| CVE-2025-11838 | 2025.1 – 2025.1.3 ; 12.6.1 – 12.11.5 | WatchGuard Firebox iked Memory Corruption Vulnerability | HIGH 8.7 | 0.5 % | ||
| CVE-2025-13940 | 2025.1 – < 2025.1.3 ; 12.8.1 – < 12.11.5 | WatchGuard Firebox Boot Time System Integrity Check Bypass | MEDIUM 6.7 | 0.1 % | ||
| CVE-2025-13939 | 2025.1 – < 2025.1.3 ; 12.0 – < 12.11.5 ; 11.7.2 – 11.12.4+541730 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Gateway Wireless Controller | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-13938 | 12.0 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-13937 | 2025.1 – < 2025.1.3 ; 12.0 – < 12.11.5 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-13936 | 2025.1 ; 12.0 – < 12.11.5 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-12196 | 2025.1 ; 12.0 – < 12.11.5 | WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Ping Command | HIGH 8.6 | 0.6 % | ||
| CVE-2025-12195 | 2025.1 – < 2025.1.3 ; 12.0 – < 12.11.5 ; 11.0 – 11.12.4+541730 | WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI IPSec Configuration | HIGH 8.6 | 0.7 % | ||
| CVE-2025-12026 | 2025.1 – < 2025.1.3 ; 12.0 – 12.11.5 | WatchGuard Firebox Authenticated Out of Bounds Write in certd | HIGH 8.6 | 0.4 % | ||
| CVE-2025-4106 | 12.0 – < 12.11.3 | WatchGuard Firebox leftover debug code vulnerability | HIGH 8.9 | 0.3 % | ||
| CVE-2025-9242 | 11.0 – 11.12.4+541730 ; 12.0 – < 12.11.4 ; 2025.0 – < 2025.1.1 | WatchGuard Firebox iked Out of Bounds Write Vulnerability | CRITICAL 9.3 | 92 % | KEV | |
| CVE-2025-6947 | 12.0 – < 12.11.3 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration | MEDIUM 4.8 | 0.5 % | ||
| CVE-2025-6999 | 12.0 – < 12.11.3 | WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-4805 | 12.0 – < 12.11.2 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal Configuration | MEDIUM 4.8 | 0.6 % | ||
| CVE-2025-4804 | 12.0 – < 12.11.2 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration | MEDIUM 4.8 | 0.5 % | ||
| CVE-2025-0178 | 12.0 – < 12.11.1 | WatchGaurd Firebox Host Header Injection Vulnerability | MEDIUM 5.1 | 0.2 % | ||
| CVE-2025-1239 | 12.0 – < 12.11.1 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List | MEDIUM 4.8 | 0.6 % | ||
| CVE-2025-1071 | 12.0 – < 12.11.1 | WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module | MEDIUM 4.8 | 0.3 % | ||
| CVE-2022-31749 | < 12.8.1 ; 12.x – < 12.1.4 ; 12.2.x – < 12.5.x ; … | Authenticated arbitrary file read/write in WatchGuard Fireware OS | MEDIUM 6.5 | 1.3 % | ||
| CVE-2024-5974 | 11.9.4 – < 12.10.4 | Firebox Authenticated Buffer Overflow Vulnerability | HIGH 8.6 | 1.1 % |