Watchguard Fireware vulnerabilities

CVE-2026-13079 [HIGH] CWE-732 CVE-2026-13079: A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.

CVE-2017-14616 [HIGH] CWE-400 CVE-2017-14616: An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in t An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible.

CVE-2022-25363 [MEDIUM] CWE-787 CVE-2022-25363: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged crede WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

CVE-2026-4266 [MEDIUM] CWE-502 CVE-2026-4266: An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obta An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including th

CVE-2022-25290 [MEDIUM] CVE-2022-25290: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged crede WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

CVE-2017-8056 [MEDIUM] CWE-611 CVE-2017-8056: WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XX WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The

CVE-2025-0178 [MEDIUM] CWE-20 CVE-2025-0178: An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the

CVE-2017-8055 [MEDIUM] CWE-203 CVE-2017-8055: WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login req WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox.

CVE-2026-3344 [MEDIUM] CWE-440 CVE-2026-3344: A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.

CVE-2026-4315 [MEDIUM] CWE-352 CVE-2026-4315: A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.

CVE-2017-14615 [MEDIUM] CWE-79 CVE-2017-14615: An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Tra

CVE-2026-3343 [MEDIUM] CWE-79 CVE-2026-3343: A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.

CVE-2026-13371 [MEDIUM] CWE-502 CVE-2026-13371: An authenticated administrator can trigger a denial-of-service condition in the Fireware Management An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.

CVE-2025-13936 [MEDIUM] CWE-79 CVE-2025-13936: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.

CVE-2025-13939 [MEDIUM] CWE-79 CVE-2025-13939: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.

CVE-2025-13937 [MEDIUM] CWE-79 CVE-2025-13937: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.

CVE-2025-13938 [MEDIUM] CWE-79 CVE-2025-13938: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.

CVE-2022-31792 [MEDIUM] CWE-79 CVE-2022-31792: A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGua A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.

CVE-2025-13940 [MEDIUM] CWE-440 CVE-2025-13940: An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attack An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system

CVE-2026-13376 [MEDIUM] CVE-2026-13376: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 u