Watchguard Fireware Os vulnerabilities

CVE-2025-1545 [HIGH] CWE-91 CVE-2025-1545: An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attack An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

CVE-2026-3342 [HIGH] CWE-787 CVE-2026-3342: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.

CVE-2026-3987 [HIGH] CWE-22 CVE-2026-3987: A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a p A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrary code in the context of an elevated system process.

CVE-2026-13054 [HIGH] CWE-22 CVE-2026-13054: A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged a A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

CVE-2025-1547 [HIGH] CWE-121 CVE-2025-1547: A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate reques A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

CVE-2025-4106 [HIGH] CWE-489 CVE-2025-4106: An authenticated admin user with access to both the management WebUI and command line interface on a An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.

CVE-2026-13084 [HIGH] CWE-476 CVE-2026-13084: A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticate A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This

CVE-2026-86132 [HIGH] CWE-191 CVE-2026-86132: An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.

CVE-2025-12195 [HIGH] CWE-787 CVE-2025-12195: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated pr An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.

CVE-2026-13053 [HIGH] CWE-787 CVE-2026-13053: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated pr An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

CVE-2025-12196 [HIGH] CWE-787 CVE-2025-12196: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated pr An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

CVE-2025-12026 [HIGH] CWE-787 CVE-2025-12026: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could a An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

CVE-2026-13224 [HIGH] CWE-22 CVE-2026-13224: A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated adm A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

CVE-2026-86104 [HIGH] CWE-400 CVE-2026-86104: An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

CVE-2026-13383 [HIGH] CWE-787 CVE-2026-13383: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authe An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

CVE-2026-13384 [HIGH] CWE-787 CVE-2026-13384: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authen An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

CVE-2026-13050 [HIGH] CWE-787 CVE-2026-13050: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authe An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

CVE-2026-86101 [HIGH] CWE-285 CVE-2026-86101: An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remo An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

CVE-2026-86134 [HIGH] CWE-476 CVE-2026-86134: A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

CVE-2026-13046 [HIGH] CWE-502 CVE-2026-13046: A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on se A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.