Watchguard

Known Exploited Watchguard Vulnerabilities

The following Watchguard vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 2 known exploited Watchguard vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 102 vulnerabilities in Watchguard with an average score of 7.7 out of ten. Last year, in 2025 Watchguard had 27 security vulnerabilities published. That is, 75 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.18.

Recent Watchguard Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-121639	Nov 04, 2026	Unauth RCE: WatchGuard AuthPoint GW DirSync Config Delete A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.	Authpoint Authentication Gateway
CVE-2026-121638	Nov 04, 2026	WatchGuard AuthPoint GW Improper Cert Validation Enables MITM An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.	Authpoint Authentication Gateway
CVE-2026-121637	Nov 04, 2026	Improper Integrity in WatchGuard AuthPoint Gateway LDAP Auth (CVE2026121637) An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.	Authpoint Authentication Gateway
CVE-2026-121640	Nov 04, 2026	AuthPoint Gateway Auth Bypass via CaptureReplay An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.	Authpoint Authentication Gateway
CVE-2026-115495	Oct 27, 2026	Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the users VPN username and password.	Mobile Vpn With Ssl Client
CVE-2026-90465	Oct 27, 2026	Missing Auth in WatchGuard FireCluster Sync Allows Root Firewall Actions A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.	Fireware Os
CVE-2026-93862	Oct 27, 2026	WatchGuard FireCluster Sync OOB Read Causing DoS An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.	Fireware Os
CVE-2026-113881	Oct 27, 2026	A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.	Fireware Os
CVE-2026-112710	Oct 27, 2026	A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.	Fireware Os
CVE-2026-112709	Oct 27, 2026	A heap-based buffer overflow vulnerability in the Fireware OS authentication service A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.	Fireware Os
CVE-2026-111107	Oct 27, 2026	A NULL pointer dereference vulnerability in WatchGuard Fireware OSs management interface A NULL pointer dereference vulnerability in WatchGuard Fireware OSs management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.	Fireware Os
CVE-2026-104381	Oct 27, 2026	A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.	Fireware Os
CVE-2026-103594	Oct 27, 2026	A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.	Fireware Os
CVE-2026-93866	Oct 27, 2026	WatchGuard Fireware OS Access Portal WebSocket Int Overflow Heap Write An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.	Fireware Os
CVE-2026-93865	Oct 27, 2026	Unauth Remote Exec via FireCluster Sync Daemon: Fireware OS A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.	Fireware Os
CVE-2026-93864	Oct 27, 2026	WatchGuard Fireware OS Firewall Daemon File Overwrite to Root A link following vulnerability in WatchGuard Fireware OSs firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.	Fireware Os
CVE-2026-93857	Oct 27, 2026	Stack Overflow in WatchGuard Fireware OS SIP Proxy (CVE-2026-93857) A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.	Fireware Os
CVE-2026-93434	Oct 27, 2026	WatchGuard Fireware OS XPath Injection in SSH Auth An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.	Fireware Os
CVE-2026-90464	Oct 27, 2026	WatchGuard Fireware OS EFPC Vulnerability: Arbitrary File Overwrite An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.	Fireware Os
CVE-2026-90442	Oct 27, 2026	Stack Overflow in Fireware OS certd (WatchGuard Firebox) A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.	Fireware Os
CVE-2026-82332	Oct 27, 2026	Impauth in WatchGuard AuthPoint MFA: Local Attacker Hijacks In-Prog Session An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.	Fireware Os
CVE-2026-96293	Oct 22, 2026	WatchGuard Endpoint Sec. Cleartext FileVault Recovery Key in Diagnostic Log A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.	Watchguard Agent
CVE-2026-13043	Oct 01, 2026	WatchGuard PSKMAD: Local Auth Bypass Enables Kernel Memory Dump A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.	Endpoint Security
CVE-2026-86134	Sep 30, 2026	WatchGuard Fireware OS Auth NULL Pointer Crash (CVE-2026-86134) A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.	Fireware Os
CVE-2026-90441	Sep 29, 2026	WatchGuard wgagent missing auth leads to crash & file read via API A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.	Fireware Os
CVE-2026-86105	Sep 29, 2026	WatchGuard Fireware OS Access Portal Reverse Proxy Improper Auth (CVE-2026-86105) An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.	Fireware Os
CVE-2026-86104	Sep 29, 2026	Fireware OS wgagent Uncontrolled Resource Consumption DoS An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.	Fireware Os
CVE-2026-86101	Sep 29, 2026	Improper Auth in WatchGuard Fireware OS SAML Login Enables Mobile VPN Access An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.	Fireware Os
CVE-2026-18145	Sep 29, 2026	Stack Buffer Overflow in WatchGuard Fireware OS spamd Service A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.	Fireware Os
CVE-2026-18105	Sep 29, 2026	LowPriv Auth DoS in Fireware OS Via Repeated Diagnostic Tasks An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.	Fireware Os
CVE-2026-13224	Sep 29, 2026	WatchGuard Fireware OS WebUI Path Traversal (CVE-2026-13224) A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.	Fireware Os
CVE-2026-13046	Sep 29, 2026	Deserialization in WatchGuard Fireware samld SAML leads to code exec A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.	Fireware Os
CVE-2026-86131	Sep 29, 2026	Code Injection in WatchGuard Fireware BOVPN TLS client config A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.	Fireware Os
CVE-2026-86133	Sep 29, 2026	WatchGuard Fireware OS IKEd Integer Underflow (DoS) An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.	Fireware Os
CVE-2026-86128	Sep 29, 2026	Fireware OS NetFlow NULL PTR DSP CVE-2026-86128 A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.	Fireware Os
CVE-2026-81433	Sep 29, 2026	Buffer Overflow in WatchGuard Fireware OS fingerd over DHCP A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.	Fireware Os
CVE-2026-86132	Sep 29, 2026	WatchGuard Fireware OS IKEv2 Daemon Integer Underflow Crash An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.	Fireware Os
CVE-2026-86136	Sep 29, 2026	Missing Auth in WatchGuard wgagent Daemon Allows Crash & File Read A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.	Fireware Os
CVE-2026-87969	Sep 28, 2026	WatchGuard AP CLI OS Command Injection (Authenticated) An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.	Watchguard Ap
CVE-2026-86102	Sep 28, 2026	WatchGuard AP API OS Command Injection Vulnerability An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.	Watchguard Ap
CVE-2026-95676	Sep 23, 2026	AuthPoint Gateway LDAP Sync Auth Bypass (CVE-2026-95676) A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.	Authpoint Authentication Gateway
CVE-2026-86135	Sep 08, 2026	WatchGuard Dimension CSRF Snapshot Creation Vulnerability A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.	Dimension
CVE-2026-78195	Aug 27, 2026	WatchGuard Dimension XSS in Historical Data Feature (Authenticated Admin)	Dimension
CVE-2026-78612	Aug 27, 2026	WatchGuard Dimension Auth SQLi in Scheduled Report Arbitrary Cmd Exec WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.	Dimension
CVE-2026-78616	Aug 27, 2026	WatchGuard Dimension XSS in Trusted CA Config A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate.	Dimension
CVE-2026-78498	Aug 27, 2026	SSRF in WatchGuard Dimension Email Server Test Config A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.	Dimension
CVE-2026-78047	Aug 27, 2026	WatchGuard Dimension XSS via Task Scheduling Field Injection A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user.	Dimension
CVE-2026-78614	Aug 27, 2026	WatchGuard Dimension Auth SQLi Leads to Local Cmd Exec via Audit Reports WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.	Dimension
CVE-2026-13108	Aug 27, 2026	WatchGuard Dimension: Denial-of-Service via TCP SYN Flood to Log Listener WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.	Dimension
CVE-2026-78615	Aug 27, 2026	WatchGuard Dimension Reflected XSS in Report Detail URL A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.	Dimension