Watchguard Fireware Os
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Watchguard Fireware Os.
By the Year
In 2026 there have been 67 vulnerabilities in Watchguard Fireware Os with an average score of 7.8 out of ten. Last year, in 2025 Fireware Os had 22 security vulnerabilities published. That is, 45 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.27.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 67 | 7.83 |
| 2025 | 22 | 6.56 |
| 2024 | 1 | 8.60 |
It may take a day or so for new Fireware Os vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Watchguard Fireware Os Security Vulnerabilities
Missing Auth in WatchGuard FireCluster Sync Allows Root Firewall Actions
CVE-2026-90465
8.7 - High
- October 27, 2026
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.
Authentication Bypass by Spoofing
WatchGuard FireCluster Sync OOB Read Causing DoS
CVE-2026-93862
7.2 - High
- October 27, 2026
An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.
Out-of-bounds Read
A NULL pointer dereference vulnerability in WatchGuard Fireware OSs management interface
CVE-2026-111107
8.7 - High
- October 27, 2026
A NULL pointer dereference vulnerability in WatchGuard Fireware OSs management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.
Improper Validation of Syntactic Correctness of Input
WatchGuard Fireware OS Firewall Daemon File Overwrite to Root
CVE-2026-93864
7.1 - High
- October 27, 2026
A link following vulnerability in WatchGuard Fireware OSs firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained.
Directory traversal
Stack Overflow in WatchGuard Fireware OS SIP Proxy (CVE-2026-93857)
CVE-2026-93857
9.2 - Critical
- October 27, 2026
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
Classic Buffer Overflow
WatchGuard Fireware OS XPath Injection in SSH Auth
CVE-2026-93434
8.7 - High
- October 27, 2026
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
Improper Input Validation
WatchGuard Fireware OS EFPC Vulnerability: Arbitrary File Overwrite
CVE-2026-90464
7.2 - High
- October 27, 2026
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
insecure temporary file
Stack Overflow in Fireware OS certd (WatchGuard Firebox)
CVE-2026-90442
8.6 - High
- October 27, 2026
A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.
Stack Overflow
Impauth in WatchGuard AuthPoint MFA: Local Attacker Hijacks In-Prog Session
CVE-2026-82332
5.6 - Medium
- October 27, 2026
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.
authentification
Unauth Remote Exec via FireCluster Sync Daemon: Fireware OS
CVE-2026-93865
9.2 - Critical
- October 27, 2026
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Missing Authentication for Critical Function
WatchGuard Fireware OS Access Portal WebSocket Int Overflow Heap Write
CVE-2026-93866
9.2 - Critical
- October 27, 2026
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
Integer Overflow or Wraparound
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker
CVE-2026-103594
9.5 - Critical
- October 27, 2026
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
Stack Overflow
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature
CVE-2026-104381
6 - Medium
- October 27, 2026
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.
Authentication Bypass by Capture-replay
A heap-based buffer overflow vulnerability in the Fireware OS authentication service
CVE-2026-112709
9.2 - Critical
- October 27, 2026
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
Heap-based Buffer Overflow
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service
CVE-2026-112710
9.2 - Critical
- October 27, 2026
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
Heap-based Buffer Overflow
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process
CVE-2026-113881
6.1 - Medium
- October 27, 2026
A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.
Stack Overflow
WatchGuard Fireware OS Auth NULL Pointer Crash (CVE-2026-86134)
CVE-2026-86134
8.7 - High
- September 30, 2026
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.
NULL Pointer Dereference
Stack Buffer Overflow in WatchGuard Fireware OS spamd Service
CVE-2026-18145
8.6 - High
- September 29, 2026
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.
Stack Overflow
Deserialization in WatchGuard Fireware samld SAML leads to code exec
CVE-2026-13046
7.5 - High
- September 29, 2026
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.
Marshaling, Unmarshaling
WatchGuard Fireware OS WebUI Path Traversal (CVE-2026-13224)
CVE-2026-13224
8.2 - High
- September 29, 2026
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
Directory traversal
LowPriv Auth DoS in Fireware OS Via Repeated Diagnostic Tasks
CVE-2026-18105
7.1 - High
- September 29, 2026
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.
Resource Exhaustion
Improper Auth in WatchGuard Fireware OS SAML Login Enables Mobile VPN Access
CVE-2026-86101
7.2 - High
- September 29, 2026
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
AuthZ
Fireware OS wgagent Uncontrolled Resource Consumption DoS
CVE-2026-86104
8.7 - High
- September 29, 2026
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
Resource Exhaustion
WatchGuard Fireware OS Access Portal Reverse Proxy Improper Auth (CVE-2026-86105)
CVE-2026-86105
5.3 - Medium
- September 29, 2026
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.
Improper Handling of Unicode Encoding
Code Injection in WatchGuard Fireware BOVPN TLS client config
CVE-2026-86131
9.2 - Critical
- September 29, 2026
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Improper Certificate Validation
WatchGuard Fireware OS IKEd Integer Underflow (DoS)
CVE-2026-86133
8.2 - High
- September 29, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
Improper Validation of Specified Quantity in Input
WatchGuard wgagent missing auth leads to crash & file read via API
CVE-2026-90441
7.1 - High
- September 29, 2026
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
Information Disclosure
WatchGuard Fireware OS IKEv2 Daemon Integer Underflow Crash
CVE-2026-86132
8.2 - High
- September 29, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
Integer underflow
Buffer Overflow in WatchGuard Fireware OS fingerd over DHCP
CVE-2026-81433
8.7 - High
- September 29, 2026
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.
Classic Buffer Overflow
Fireware OS NetFlow NULL PTR DSP CVE-2026-86128
CVE-2026-86128
8.2 - High
- September 29, 2026
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
NULL Pointer Dereference
Missing Auth in WatchGuard wgagent Daemon Allows Crash & File Read
CVE-2026-86136
7.1 - High
- September 29, 2026
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
Directory traversal
WatchGuard Fireware OS Type Confusion in iked Allows Remote Code Execution
CVE-2026-19315
9.3 - Critical
- August 27, 2026
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Heap Overflow Remote Exploit
CVE-2026-19313
9.3 - Critical
- August 27, 2026
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Heap-based Buffer Overflow
WatchGuard Fireware OS iked Integer Underflow Remote DoS
CVE-2026-19314
8.7 - High
- August 27, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Integer underflow
WatchGuard Fireware OS iked Double-Free DoS Vulnerability
CVE-2026-19316
8.7 - High
- August 27, 2026
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Double-free
WatchGuard Fireware OS OOB Read in iked Process Enables Remote DoS
CVE-2026-19317
8.7 - High
- August 27, 2026
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Process Buffer Overflow Vulnerability
CVE-2026-19318
9.3 - Critical
- August 27, 2026
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Stack Overflow
WatchGuard Fireware OS WebUI Buffer Overflow
CVE-2026-78008
8.6 - High
- August 27, 2026
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Memory Corruption
WatchGuard Fireware OS OOB Read in iked Causing DoS
CVE-2026-78009
8.7 - High
- August 27, 2026
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Buffer Overflow DoS CVE-2026-78010
CVE-2026-78010
8.7 - High
- August 27, 2026
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Stack Overflow
WatchGuard Fireware OS iked Integer Underflow DoS Vulnerability
CVE-2026-78011
8.7 - High
- August 27, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Integer underflow
WatchGuard Fireware OS epm Buffer Overflow (CVE-2026-13086)
CVE-2026-13086
9.3 - Critical
- August 27, 2026
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Stack Overflow
CVE-2026-81851: Heap Buffer Overflow in Fireware OS iked for Auth Admin DoS
CVE-2026-81851
6.9 - Medium
- August 27, 2026
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
Heap-based Buffer Overflow
Out-of-bounds Write in WatchGuard Fireware OS CLI (11.012.12, 20252026)
CVE-2026-13053
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.
Memory Corruption
WatchGuard Fireware OS <=11.12.4/12.12/2026.2 networkd OOB Write (auth)
CVE-2026-13050
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
Memory Corruption
Path Traversal in WatchGuard Fireware OS 11.0-12.12 webUI Enables File Write
CVE-2026-13054
8.6 - High
- July 02, 2026
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.
Directory traversal
WatchGuard Mobile VPN with SSL client for Windows 2026.2 Privilege Escalation
CVE-2026-13079
7.3 - High
- July 02, 2026
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.
Incorrect Permission Assignment for Critical Resource
OOB Write in WatchGuard Fireware OS < 12.12 (Unauth Exec)
CVE-2026-8247
7.7 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Classic Buffer Overflow
WatchGuard Fireware OS 12.x/2025.x Hard-Coded Key Vulnerability in Access Portal
CVE-2026-13728
5.9 - Medium
- July 02, 2026
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Use of Hard-coded Credentials
WatchGuard Fireware OS 11.10.212.12 IKEv2 DoS via NULL PTR
CVE-2026-13084
8.7 - High
- July 02, 2026
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
NULL Pointer Dereference
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Watchguard Fireware Os or by Watchguard? Click the Watch button to subscribe.
