Watchguard Fireware Os
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Watchguard Fireware Os.
By the Year
In 2026 there have been 51 vulnerabilities in Watchguard Fireware Os with an average score of 7.7 out of ten. Last year, in 2025 Fireware Os had 22 security vulnerabilities published. That is, 29 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.18.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 51 | 7.75 |
| 2025 | 22 | 6.56 |
| 2024 | 1 | 8.60 |
It may take a day or so for new Fireware Os vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Watchguard Fireware Os Security Vulnerabilities
WatchGuard Fireware OS Auth NULL Pointer Crash (CVE-2026-86134)
CVE-2026-86134
8.7 - High
- September 30, 2026
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.
NULL Pointer Dereference
Improper Auth in WatchGuard Fireware OS SAML Login Enables Mobile VPN Access
CVE-2026-86101
7.2 - High
- September 29, 2026
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
AuthZ
Deserialization in WatchGuard Fireware samld SAML leads to code exec
CVE-2026-13046
7.5 - High
- September 29, 2026
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.
Marshaling, Unmarshaling
WatchGuard Fireware OS WebUI Path Traversal (CVE-2026-13224)
CVE-2026-13224
8.2 - High
- September 29, 2026
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
Directory traversal
LowPriv Auth DoS in Fireware OS Via Repeated Diagnostic Tasks
CVE-2026-18105
7.1 - High
- September 29, 2026
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.
Resource Exhaustion
Stack Buffer Overflow in WatchGuard Fireware OS spamd Service
CVE-2026-18145
8.6 - High
- September 29, 2026
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.
Stack Overflow
Fireware OS wgagent Uncontrolled Resource Consumption DoS
CVE-2026-86104
8.7 - High
- September 29, 2026
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
Resource Exhaustion
WatchGuard Fireware OS Access Portal Reverse Proxy Improper Auth (CVE-2026-86105)
CVE-2026-86105
5.3 - Medium
- September 29, 2026
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.
Improper Handling of Unicode Encoding
Code Injection in WatchGuard Fireware BOVPN TLS client config
CVE-2026-86131
9.2 - Critical
- September 29, 2026
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Improper Certificate Validation
WatchGuard Fireware OS IKEd Integer Underflow (DoS)
CVE-2026-86133
8.2 - High
- September 29, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.
Improper Validation of Specified Quantity in Input
WatchGuard wgagent missing auth leads to crash & file read via API
CVE-2026-90441
7.1 - High
- September 29, 2026
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
Information Disclosure
Fireware OS NetFlow NULL PTR DSP CVE-2026-86128
CVE-2026-86128
8.2 - High
- September 29, 2026
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.
NULL Pointer Dereference
Buffer Overflow in WatchGuard Fireware OS fingerd over DHCP
CVE-2026-81433
8.7 - High
- September 29, 2026
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.
Classic Buffer Overflow
WatchGuard Fireware OS IKEv2 Daemon Integer Underflow Crash
CVE-2026-86132
8.2 - High
- September 29, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.
Integer underflow
Missing Auth in WatchGuard wgagent Daemon Allows Crash & File Read
CVE-2026-86136
7.1 - High
- September 29, 2026
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
Directory traversal
WatchGuard Fireware OS Type Confusion in iked Allows Remote Code Execution
CVE-2026-19315
9.3 - Critical
- August 27, 2026
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Integer Underflow DoS Vulnerability
CVE-2026-78011
8.7 - High
- August 27, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Integer underflow
WatchGuard Fireware OS epm Buffer Overflow (CVE-2026-13086)
CVE-2026-13086
9.3 - Critical
- August 27, 2026
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Stack Overflow
WatchGuard Fireware OS iked Heap Overflow Remote Exploit
CVE-2026-19313
9.3 - Critical
- August 27, 2026
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Heap-based Buffer Overflow
WatchGuard Fireware OS iked Integer Underflow Remote DoS
CVE-2026-19314
8.7 - High
- August 27, 2026
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Integer underflow
WatchGuard Fireware OS iked Double-Free DoS Vulnerability
CVE-2026-19316
8.7 - High
- August 27, 2026
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Double-free
WatchGuard Fireware OS OOB Read in iked Process Enables Remote DoS
CVE-2026-19317
8.7 - High
- August 27, 2026
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Process Buffer Overflow Vulnerability
CVE-2026-19318
9.3 - Critical
- August 27, 2026
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Stack Overflow
WatchGuard Fireware OS WebUI Buffer Overflow
CVE-2026-78008
8.6 - High
- August 27, 2026
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Memory Corruption
WatchGuard Fireware OS OOB Read in iked Causing DoS
CVE-2026-78009
8.7 - High
- August 27, 2026
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Out-of-bounds Read
WatchGuard Fireware OS iked Buffer Overflow DoS CVE-2026-78010
CVE-2026-78010
8.7 - High
- August 27, 2026
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
Stack Overflow
CVE-2026-81851: Heap Buffer Overflow in Fireware OS iked for Auth Admin DoS
CVE-2026-81851
6.9 - Medium
- August 27, 2026
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
Heap-based Buffer Overflow
Out-of-bounds Write in WatchGuard Fireware OS CLI (11.012.12, 20252026)
CVE-2026-13053
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.
Memory Corruption
WatchGuard Fireware OS <=11.12.4/12.12/2026.2 networkd OOB Write (auth)
CVE-2026-13050
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
Memory Corruption
Path Traversal in WatchGuard Fireware OS 11.0-12.12 webUI Enables File Write
CVE-2026-13054
8.6 - High
- July 02, 2026
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.
Directory traversal
WatchGuard Mobile VPN with SSL client for Windows 2026.2 Privilege Escalation
CVE-2026-13079
7.3 - High
- July 02, 2026
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.
Incorrect Permission Assignment for Critical Resource
OOB Write in WatchGuard Fireware OS < 12.12 (Unauth Exec)
CVE-2026-8247
7.7 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Classic Buffer Overflow
WatchGuard Fireware OS 12.x/2025.x Hard-Coded Key Vulnerability in Access Portal
CVE-2026-13728
5.9 - Medium
- July 02, 2026
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Use of Hard-coded Credentials
WatchGuard Fireware OS 11.10.212.12 IKEv2 DoS via NULL PTR
CVE-2026-13084
8.7 - High
- July 02, 2026
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
NULL Pointer Dereference
WatchGuard Fireware OS <11.12.4/12.12/2026.2: LDAP AUC Race in Mobile VPN IKE
CVE-2026-13368
9.2 - Critical
- July 02, 2026
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that have a Mobile VPN with IKEv2 configured to use an external LDAP authentication server.
Dangling pointer
WatchGuard Fireware OS FW Validation Bypass (Auth Admin) <=12.12
CVE-2026-13722
8.6 - High
- July 02, 2026
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.
Improper Verification of Cryptographic Signature
WatchGuard Fireware OS OOB Write in wgagent (12.12, 2026.2)
CVE-2026-13384
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
Memory Corruption
WatchGuard Fireware OS 12.1-12.12/2025.1-2026.2 OOB Write in ikestubd via UI
CVE-2026-13383
8.6 - High
- July 02, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
Memory Corruption
WatchGuard Fireware OS SIP Proxy XSS 12.012.12/12.512.5.18/2025.12026.2
CVE-2026-13377
4.8 - Medium
- July 02, 2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.
XSS
Stored XSS in WatchGuard Fireware OS spamBlocker 12.012.12
CVE-2026-13376
4.8 - Medium
- July 02, 2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
XSS
WatchGuard Fireware OS XSS in Autotask Module 12.4-12.12
CVE-2026-13375
4.8 - Medium
- July 02, 2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
XSS
WatchGuard Fireware OS ConnectWise Stored XSS (<=2026.2)
CVE-2026-13374
4.8 - Medium
- July 02, 2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.
XSS
WatchGuard Fireware OS XSS in Tigerpaw Module up to 12.12 & 2026.2
CVE-2026-13373
4.8 - Medium
- July 02, 2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936.
XSS
WatchGuard Fireware UI unsafe deserialization DoS
CVE-2026-13371
6.9 - Medium
- July 02, 2026
An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.
Marshaling, Unmarshaling
WatchGuard Fireware OS WebUI Path Traversal (12.6.1-12.11.8, 2025.1-2026.1.2)
CVE-2026-3987
8.6 - High
- April 01, 2026
A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.
Directory traversal
WatchGuard Fireware OS 11.8-12.11.8 / 2025.1-2026.1.2 CSRF Causing WebUI DoS
CVE-2026-4315
7.1 - High
- March 30, 2026
A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.
Session Riding
Insecure Deserialization in WatchGuard Fireware OS portald (v12.1-v12.11.8, 2025.1-2026.1.2)
CVE-2026-4266
8.4 - High
- March 30, 2026
An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including the T15 and T35.
Marshaling, Unmarshaling
WatchGuard FW OS <=12.11.7: FS Integrity Bypass via Malicious Firmware Update
CVE-2026-3344
6.9 - Medium
- March 03, 2026
A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.
Expected Behavior Violation
Reflected XSS in WatchGuard Fireware OS 12.7-12.11.7 Web UI
CVE-2026-3343
5.1 - Medium
- March 03, 2026
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
XSS
WatchGuard Fireware OS OOB Write via Mgmt Interface
CVE-2026-3342
- March 03, 2026
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Watchguard Fireware Os or by Watchguard? Click the Watch button to subscribe.
