Watchguard Fireware Os vulnerabilities

CVE-2026-1498 [HIGH] CWE-90 CVE-2026-1498: An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacke An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from a connected LDAP authentication server through an exposed authentication or management web interface. This vulnerability may also allow a remote attacker to authenticate as an LDAP user with a partial identifier if

CVE-2026-13722 [HIGH] CWE-347 CVE-2026-13722: WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.

CVE-2024-5974 [HIGH] CWE-120 CVE-2024-5974: A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with pr A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. This issue affects Fireware OS: from 11.9.6 through 12.10.3.

CVE-2026-86105 [HIGH] CWE-22 CVE-2026-86105: An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authe An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVE-2022-31749 [MEDIUM] CWE-88 CVE-2022-31749: An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware O An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances

CVE-2025-11838 [HIGH] CWE-763 CVE-2025-11838: A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

CVE-2026-86128 [HIGH] CWE-476 CVE-2026-86128: A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

CVE-2026-86133 [HIGH] CWE-191 CVE-2026-86133: An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote a An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.

CVE-2025-6999 [MEDIUM] CWE-444 CVE-2025-6999: An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Firewar An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack. WatchGuard does not believe there is a practical exploit chain with a meaningful security impact for this vulnerability.

CVE-2026-81851 [MEDIUM] CWE-122 CVE-2026-81851: A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated adm A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.

CVE-2026-4266 [MEDIUM] CWE-502 CVE-2026-4266: An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obta An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another vulnerability to execute arbitrary code in the context of the portald user. Note, this vulnerability does not affect Firebox platforms that do not support the Access Portal feature, including th

CVE-2026-18105 [HIGH] CWE-400 CVE-2026-18105: An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

CVE-2025-0178 [MEDIUM] CWE-20 CVE-2025-0178: An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the

CVE-2026-3344 [MEDIUM] CWE-440 CVE-2026-3344: A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.

CVE-2026-4315 [MEDIUM] CWE-352 CVE-2026-4315: A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.

CVE-2026-3343 [MEDIUM] CWE-79 CVE-2026-3343: A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.

CVE-2026-13371 [MEDIUM] CWE-502 CVE-2026-13371: An authenticated administrator can trigger a denial-of-service condition in the Fireware Management An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.

CVE-2025-13936 [MEDIUM] CWE-79 CVE-2025-13936: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.

CVE-2025-13939 [MEDIUM] CWE-79 CVE-2025-13939: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.

CVE-2025-13937 [MEDIUM] CWE-79 CVE-2025-13937: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.