Watchguard

Known Exploited Watchguard Vulnerabilities

The following Watchguard vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2022-26318: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited Watchguard vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 4 vulnerabilities in Watchguard. Last year, in 2025 Watchguard had 21 security vulnerabilities published. Right now, Watchguard is on track to have less security vulnerabilities in 2026 than it did last year.

Recent Watchguard Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-3344	Mar 03, 2026	WatchGuard FW OS <=12.11.7: FS Integrity Bypass via Malicious Firmware Update A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.This issue affects Fireware OS 12.0 up to and including 12.11.7, 12.5.9 up to and including 12.5.16, and 2025.1 up to and including 2026.1.1.	Fireware Os
CVE-2026-3343	Mar 03, 2026	Reflected XSS in WatchGuard Fireware OS 12.7-12.11.7 Web UI A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link. This vulnerability affects Fireware OS 12.7 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.	Fireware Os
CVE-2026-3342	Mar 03, 2026	WatchGuard Fireware OS OOB Write via Mgmt Interface An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.	Fireware Os
CVE-2026-1498	Jan 30, 2026	WatchGuard Fireware OS LDAP Injection (12.012.11.6, 12.512.5.15, 2025.12026.0) An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if they additionally have that user's valid passphrase.This issue affects Fireware OS: from 12.0 through 12.11.6, from 12.5 through 12.5.15, from 2025.1 through 2026.0.	Fireware Os
CVE-2025-14733	Dec 19, 2025	WatchGuard Fireware OS OOB Write CVE-2025-14733 (2025.1.3) An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.	Fireware Os
CVE-2025-1547	Dec 04, 2025	WatchGuard Fireware OS 12.012.11.2 Buffer Overflow in cert request CLI A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.2.	Fireware Os
CVE-2025-1910	Dec 04, 2025	WatchGuard Mobile VPN SSL Client LPE on Windows up to 12.11.2 The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.	Mobile Vpn With Ssl Client
CVE-2025-6946	Dec 04, 2025	XSS via WatchGuard FW OS IPS Module (12.012.11.2) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.	Fireware Os
CVE-2025-1545	Dec 04, 2025	WatchGuard Fireware OS 11-12.5 & 2025.1 XPath Injection in Auth Hotspot An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.This issue affects Fireware OS 11.11 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-11838	Dec 04, 2025	WatchGuard Fireware OS DoS via IKEv2 Mobile VPN (12.0-12.11.4,2025.1-2025.1.2) A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-13940	Dec 04, 2025	WatchGuard Fireware OS 12.8.1-12.11.4 Boot Integrity Check Bypass (CWE-440) An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.This issue affects Fireware OS: from 12.8.1 through 12.11.4, from 2025.1 through 2025.1.2.	Fireware Os
CVE-2025-13939	Dec 04, 2025	Stored XSS in WatchGuard Fireware OS GW Controller (<=12.11.4) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.This issue affects Fireware OS 11.7.2 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-13938	Dec 04, 2025	WatchGuard Fireware OS Stored XSS (Autotask) v12.4-2025.1.2 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-13937	Dec 04, 2025	XSS in WatchGuard Fireware OS V12.4-12.11.4 (ConnectWise Module) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-13936	Dec 04, 2025	WatchGuard Fireware OS XSS via Tigerpaw Module (12.42025.1.2) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os
CVE-2025-12196	Dec 04, 2025	OOB Write in WatchGuard FWOS CLI (12.012.11.4, 12.512.5.13, 2025.12025.1.2) An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Firebox Fireware Os
CVE-2025-12195	Dec 04, 2025	WatchGuard Fireware OS 11.0-12.11.4 OOB Write via CLI Commands An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.This vulnerability affects Fireware OS 11.0 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Firebox Fireware Os
CVE-2025-12026	Dec 04, 2025	WatchGuard Fireware OS <12.12> OOB Write via Cert CLI (CVE-2025-12026) An Out-of-bounds Write vulnerability in WatchGuard Fireware OSs certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.	Fireware Os Fireware
CVE-2025-59396	Nov 06, 2025	WatchGuard Firebox SSH 4118 Default Auth Flaw	Firebox
CVE-2025-1549	Oct 29, 2025	WatchGuard Mobile VPN SSL: Local Priv Elevation (fixed v12.11.3) A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5	Mobile Vpn With Ssl Mobile Vpn With Ssl Client
CVE-2025-4106	Oct 24, 2025	Firebox Pre12.11.2: Auth Admin Enables Debug Shell via Uploaded DIAG PKG An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command. This issue affects Fireware OS: from 12.0 before 12.11.2.	Fireware
CVE-2025-9242	Sep 17, 2025	OOB Write WatchGuard Fireware OS 11.10.2-12.11.3 Mobile/Branch VPN (IKEv2) RCE An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.	Fireware Os
CVE-2025-6947	Sep 15, 2025	WatchGuard Fireware XSS via SIP Proxy (12.0-12.11.2) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.	Firebox
CVE-2025-6999	Sep 15, 2025	WatchGuard Fireware OS Auth Portal HTTP Req Smuggling xXSS (12.0–12.11.2) An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack.This issue affects Fireware OS: from 12.0 through 12.11.2.	Fireware Os
CVE-2025-4805	May 16, 2025	WatchGuard Fireware OS 12.0-12.11.1 Stored XSS via Authenticated Admin Session Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Fireware OS: from 12.0 through 12.11.1.	Fireware
CVE-2024-13043	Dec 30, 2024	Panda Security Dome Hotspot Shield Local Privilege Escalation via Link Following Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hotspot Shield. By creating a junction, an attacker can abuse the application to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23478.	Panda Dome
CVE-2024-6594	Sep 25, 2024	WatchGuard SSO Client v12.7 Crash via Malformed Commands Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands. This issue affects Single Sign-On Client: through 12.7.	Single Sign On Client
CVE-2024-6593	Sep 25, 2024	Incorrect Auth in WatchGuard Auth Gateway <12.10.3 (Windows) Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. This issue affects Authentication Gateway: through 12.10.2.	Authentication Gateway
CVE-2024-6592	Sep 25, 2024	Auth Bypass in WatchGuard Auth Gateway 12.10.2 via InterProcess Comm Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.	Single Sign On Client Authentication Gateway
CVE-2024-4944	Jul 09, 2024	Privilege Escalation in WatchGuard MobileVPN SSL Client on Windows A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged.	Mobile Vpn With Ssl
CVE-2024-5974	Jul 09, 2024	WatchGuard Fireware OS 11.9.6-12.10.3 Buffer Overflow Allows Auth Exec A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. This issue affects Fireware OS: from 11.9.6 through 12.10.3.	Fireware
CVE-2024-3661	May 06, 2024	DHCP Client Leak via Classless Static Route (121) DHCP can add routes to a clients routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.	Mobile Vpn With Ssl Ipsec Mobile Vpn Client
CVE-2023-37849	Jul 13, 2023	DLL Hijack in PandaVPN Win <v15.14.8 CVE-2023-37849 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe.	Panda Security Vpn
CVE-2022-31789	Sep 06, 2022	Integer Overflow in WatchGuard Firebox/XTM before 12.8.1 An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.	Fireware Firebox
CVE-2022-31791	Sep 06, 2022	WatchGuard Fireware OS PrivEsc Local Shell to Root (12.8.1) WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.	Fireware
CVE-2022-31792	Sep 06, 2022	Stored XSS in WatchGuard Firebox/XTM Web UI (Before 12.8.1/12.5.10/12.1.4) A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.	Fireware Firebox
CVE-2022-31790	Sep 06, 2022	Unauth Remote Disclosure via Auth Endpoints in WatchGuard Firebox (before 12.8.1) WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.	Fireware Firebox
CVE-2022-26318	Mar 04, 2022	On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-25293	Feb 24, 2022	A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-25363	Feb 24, 2022	WatchGuard Firebox and XTM appliances WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-25290	Feb 24, 2022	WatchGuard Firebox and XTM appliances WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-23176	Feb 24, 2022	WatchGuard Firebox and XTM appliances WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.	Fireware
CVE-2022-25360	Feb 24, 2022	WatchGuard Firebox and XTM appliances WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-25292	Feb 24, 2022	A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2022-25291	Feb 24, 2022	An integer overflow in WatchGuard Firebox and XTM appliances An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.	Fireware
CVE-2021-34998	Jan 13, 2022	This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0 This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.	Panda Antivirus
CVE-2020-10532	Mar 12, 2020	The AD Helper component in WatchGuard Fireware before 5.8.5.10317 The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI.	Ad Helper Firmware
CVE-2017-8060	May 05, 2017	Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.	Panda Mobile Security
CVE-2017-8339	Apr 30, 2017	PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\ PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver.	Panda Antivirus
CVE-2015-7378	Apr 18, 2016	Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.	Panda Url Filtering